High severity · published Mar 26, 2021
CVE-2021-21389
BuddyPress is an open source WordPress plugin to build a community site
8.8
CVSS
13.5%
EPSS
No
On KEV
Description
BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the REST API members endpoint. The vulnerability has been fixed in BuddyPress 7.2.1. Existing installations of the plugin should be updated to this version to mitigate the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)13.5% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BU
Buddypress · Buddypress
5.0.0 before 7.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-21389
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-21389
Release Notes
https://buddypress.org/2021/03/buddypress-7-2-1-security-release/
Release Notes
https://codex.buddypress.org/releases/version-7-2-1/
Third Party Advisory
https://github.com/buddypress/BuddyPress/security/advisories/GHSA-m6j4-8r7p-wpp3
More from Buddypress
8.5
CVE-2026-111850
WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability
8.1
CVE-2026-53673
BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter
8.1
CVE-2024-10011
The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter
7.5
CVE-2026-1360
BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data
7.5
CVE-2025-62022
WordPress BuddyPress plugin <= 14.3.4 - Broken Access Control vulnerability