CVE-2024-12145

The BuddyPress WordPress plugin (versions ≤ 14.3.3 ) is vulnerable to an Insecure Direct Object Reference in the bp_notifications_action_bulk_manage function, caused by missing validation on a user-controlled key. Authenticated attackers with Subscriber-level access or higher can delete or change...