BuddyPress <= 14.3.3 - Unauthentifizierte Arbiträre Shortcode-Ausführung

The arbitrary shortcode execution vulnerability in BuddyPress poses a significant risk to WordPress websites utilizing the plugin. An attacker could leverage this flaw to inject malicious code into the site through specially crafted shortcodes. This could lead to a variety of attacks, including defacement, data theft, redirection to malicious sites, and even complete site takeover. The ability to execute arbitrary code without authentication dramatically increases the potential impact, as it bypasses standard access controls. Successful exploitation could also allow attackers to gain access to sensitive user data stored within the BuddyPress plugin, such as profile information and private messages. The impact is amplified on sites with shared hosting environments, where a compromised BuddyPress installation could potentially affect other websites on the same server.

WordPress websites utilizing the BuddyPress plugin, particularly those running versions prior to 14.3.4, are at risk. Shared hosting environments are especially vulnerable, as a compromised BuddyPress installation on one site could potentially impact others on the same server. Sites with custom shortcode implementations or plugins that interact with BuddyPress are also at increased risk.

• wordpress / composer / npm:

grep -r 'do_shortcode' /var/www/html/wp-content/plugins/buddypress/

• wordpress / composer / npm:

wp plugin list --status=active | grep buddypress

• wordpress / composer / npm:

wp plugin update buddypress --all

• generic web: Check for unusual shortcode usage in website content, particularly in areas accessible to unauthenticated users.

1. 2026-01-22Disclosure

   disclosure

1. Reserviert2024-11-28
2. Veröffentlicht2026-01-22
3. Geändert2026-01-23
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2024-11976 is to immediately upgrade BuddyPress to version 14.3.4 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the BuddyPress plugin to reduce the attack surface. While a direct WAF rule is difficult to implement without specific shortcode patterns, a general rule blocking suspicious shortcode usage could provide a limited layer of protection. Regularly review and audit shortcode usage within your WordPress site to identify and remove any potentially malicious shortcodes. Ensure that WordPress core and all other plugins are also up to date to minimize overall vulnerabilities.

Aktive Installationen

100KBeliebt

Plugin-Bewertung