The BuddyPress plugin for WordPress versions prior to 14.5.0 contains an authorization bypass vulnerability (CWE-639) in its private messaging endpoints. The plugin does not properly enforce authorization checks, allowing any authenticated user with Subscriber or higher privileges to access, modify, or delete private messages belonging to other users. This vulnerability has a CVSS 3.1 base score of 5.4, indicating a medium severity impact with network attack vector, low attack complexity, and no user interaction required. There is no official remediation level or patch information provided in the available data.

Exploitation of this vulnerability allows an authenticated user to read, modify, or delete private messages of other users within the BuddyPress plugin. This compromises the confidentiality and integrity of private communications but does not affect availability. The impact is limited to users who can authenticate to the WordPress site, starting from Subscriber role and above.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions carefully to limit access to the private messaging functionality. Monitor for vendor updates regarding a security patch for BuddyPress version 14.5.0 or later.