Topic: Plugin vulnerability · BuddyPress.org

Skip to:: Content; Pages; Categories; Search; Top; Bottom

Plugin vulnerability

@lprostickamwn

Participant

3 weeks ago

We noticed that the latest version, 14.5.4, has a high priority Deserialization of untrusted data vulnerability. Here is the link to Patchstack that details the vulnerability: https://patchstack.com/database/wordpress/plugin/buddypress/vulnerability/wordpress-buddypress-plugin-14-5-0-authenticated-subscriber-php-object-injection-vulnerability. We wanted to bring this to your attention because the current version of the plugin is vulnerable and there there is currently no update that patches the issue. Please issue an update to the plugin that patches the issue and let us know when the vulnerability is patched. Thanks very much!

Viewing 2 replies - 1 through 2 (of 2 total)

@emaralive

Moderator

3 weeks ago

There was an attempt to address the vulnerability in 14.5.4, see the Version 14.5.4 changelog. The 5th bulleted item reads:

Prevent exploit of maybe_unserialize() function. Special thanks to a WordFence researcher who first reported this issue responsibly.

At the moment, I’m not sure why there is a conflict in understanding. We will investigate this further.

@venutius

Moderator

2 weeks, 6 days ago

I have a patch for this and 11 other vulnerabilities. I tried to submit a report with the patch to HackerOne and after an hour I gave up.
I will make this available via my web site later today.
I’ve no idea why they make this so hard.
Also, the previous patch I suggested would have fixed this in the first place.
My website may still be blocked from this forum for being too helpful in the past.
We shall see.

Viewing 2 replies - 1 through 2 (of 2 total)

You must be logged in to reply to this topic.