{"id":"CVE-2021-21389","aliases":["GHSA-m6j4-8r7p-wpp3"],"url":"https://o3.security/vulnerability/CVE-2021-21389","summary":"BuddyPress privilege escalation via REST API","details":"### Impact\nIt's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the BuddyPress REST API members endpoint.\n\n### Patches\nThe vulnerability has been fixed in BuddyPress 7.2.1. Existing installations of the plugin should be updated to this version to mitigate the issue.\n\n### References\nhttps://buddypress.org/2021/03/buddypress-7-2-1-security-release/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [HackerOne](https://hackerone.com/wordpress)","published":"2021-03-26T21:15:13.520Z","modified":"2026-10-20T10:54:28.484032412Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.13521,"percentile":0.96179,"asOf":"2026-09-02"},"cisaKev":null,"exploitsKnown":2,"affectedPackages":[{"ecosystem":"Packagist","name":"buddypress/buddypress","fixedVersion":"7.2.1"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://buddypress.org/2021/03/buddypress-7-2-1-security-release/"},{"type":"ADVISORY","url":"https://codex.buddypress.org/releases/version-7-2-1/"},{"type":"ADVISORY","url":"https://github.com/buddypress/BuddyPress/security/advisories/GHSA-m6j4-8r7p-wpp3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21389"},{"type":"WEB","url":"https://buddypress.org/2021/03/buddypress-7-2-1-security-release"},{"type":"WEB","url":"https://codex.buddypress.org/releases/version-7-2-1"},{"type":"PACKAGE","url":"https://github.com/buddypress/BuddyPress"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-20T10:54:28.484032412Z"}}