Missing Authorization Vulnerability in bbPress API by Pascal Casier
CVE-2025-24763

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Bbpress Api
Vendor
CVE Published:
6 June 2025

What is CVE-2025-24763?

The bbPress API, developed by Pascal Casier, contains a missing authorization vulnerability that allows attackers to exploit improperly configured access control security levels. This flaw can enable unauthorized users to access sensitive data and perform actions that should be restricted, potentially compromising the integrity and confidentiality of user interactions within the bbPress platform.

Affected Version(s)

bbPress API <= 1.0.14

References

https://patchstack.com/database/wordpress/plugin/bbp-api/...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ch4r0n (Patchstack Alliance)
.
CVE-2025-24763 : Missing Authorization Vulnerability in bbPress API by Pascal Casier