Privilege Escalation Vulnerability in BuddyPress Groupblog Plugin for WordPress

CVE-2026-5144

What is CVE-2026-5144?

The BuddyPress Groupblog plugin for WordPress is susceptible to a privilege escalation vulnerability stemming from its group blog settings handler. It inadequately processes parameters from user input, such as groupblog-blogid, default-member, and groupblog-silent-add, without sufficient authorization checks. This oversight permits group administrators, including subscribers who establish groups, to link their group to any blog within the Multisite network, encompassing the primary site (blog ID 1). Additionally, the default-member parameter permits any WordPress role, neglecting validation against a whitelist. This flaw allows malicious users to escalate roles, potentially elevating a subscriber to administrator status on the main site upon joining the attacker's group, thereby posing a significant security risk.

References