Description
WordPress Plugin BuddyPress is prone to multiple security bypass vulnerabilities. Exploiting these issues may allow attackers to perform otherwise restricted actions and subsequently elevate their privileges to Administrator role, read private messages, add/edit/delete BuddyPress Member Types from the Administration screens, or more. WordPress Plugin BuddyPress version 7.2.0 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 7.2.1 or latest
References
https://codex.buddypress.org/releases/version-7-2-1/
https://plugins.svn.wordpress.org/buddypress/trunk/readme.txt
Related Vulnerabilities
Drupal Core 7.x Cross-Site Request Forgery (7.0 - 7.12)
WebLogic CVE-2016-3586 Vulnerability (CVE-2016-3586)
Piwigo URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2017-9464)
WordPress 4.9.x Multiple Vulnerabilities (4.9 - 4.9.16)
Apache Tomcat Resource Management Errors Vulnerability (CVE-2011-4858)