BuddyTask Plugin Vulnerability

MEDIUM (6.5) No Patch (2 days)
cwe-862ajax-endpoint-vulnerabilitybuddypressphppluginwordpress

Threat Intelligence

Low Risk
EPSS Score: 0.03% chance of exploitation (percentile: 9%)
🔍 Detection Tools: None available in major open-source tools
⚔️ Exploit Availability: No public exploits found

How we test →

What is it?

The BuddyTask plugin is a WordPress plugin used to manage task boards and collaboration features. It's designed for BuddyPress groups, allowing users to create, edit, and delete tasks within these groups. However, due to a missing capability check on multiple AJAX endpoints, authenticated attackers with Subscriber-level access and above can view, create, modify, and delete task boards belonging to any BuddyPress group, including private and hidden groups they are not members of.

Am I affected?

You're affected if you use BuddyTask. Specific version info not stated in the advisory.

Affected Products

Automattic (BuddyPress) / BuddyTask

How to fix

To fix this vulnerability, upgrade to BuddyTask version 1.4.0 or later. You can do this by:

  • Using the WordPress dashboard: Go to Plugins > Installed Plugins and search for "BuddyTask". Click Update next to the plugin.
  • Using wp-cli: Run the following command:
wp-cli --user=your-username --password=your-password plugin update buddytask

Immediate mitigations:

  • Restrict network access to your WordPress installation (firewall it from the public internet)
  • Audit admin account activity for suspicious access patterns
  • Monitor for unauthorized task board modifications

References