Critical · published May 5, 2025
🚨 A simple OAuth request could let attackers stroll in as any user, including your admin! 🔥 Think of it like a hotel where anyone can sneak in with just an email address, bypassing the front desk completely — no ID required! This vulnerability allows attackers to log in as any existing user on the WordPress site, which could lead to unauthorized access to sensitive data, full control over the site, or even making destructive changes. Imagine if someone could impersonate your admin and wreak havoc, or worse, steal your users' information!
Think of it like a hotel where anyone can sneak in with just an email address, bypassing the front desk completely — no ID required! The BuddyBoss Platform Pro plugin suffers from an authentication bypass due to insufficient verification of the user during the Apple OAuth authentication process. As a result, unauthenticated attackers can gain access simply by providing a legitimate email associated with an existing user.
This vulnerability allows attackers to log in as any existing user on the WordPress site, which could lead to unauthorized access to sensitive data, full control over the site, or even making destructive changes. Imagine if someone could impersonate your admin and wreak havoc, or worse, steal your users' information! Update the BuddyBoss Platform Pro plugin to version 2.7.02 or later immediately to patch this vulnerability. Additionally, review your user access logs and ensure that no unauthorized logins have occurred during this window. Don't forget to enforce strong authentication practices! You've got this! Follow these steps, and you'll be on your way to securing your site in no time! 🛡️