Unauthorized Access in BuddyPress WooCommerce Member Pages Plugin for WordPress
CVE-2024-13358
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 1 March 2025
What is CVE-2024-13358?
The BuddyPress WooCommerce My Account Integration plugin for WordPress is vulnerable to unauthorized access due to inadequate capability checks in the wc4bp_delete_page() function. This flaw allows authenticated users with Subscriber-level access or higher to manipulate the plugin’s page settings, potentially exposing sensitive information or altering site configurations. This issue affects all versions up to and including 3.4.24, necessitating prompt attention and remediation from affected users.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages * <= 3.4.24
References
CVSS V3.1
Timeline
Vulnerability published
Vulnerability Reserved