CVE-2024-10011 BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal

What is CVE-2024-10011?

CVE-2024-10011 is a high-severity path traversal vulnerability in BuddyPress, published on 25 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory and enables file uploads to directories outside of the web root. Depending on server configuration it may be possible to upload files with double extensions.

Weakness: CWE-22

Which versions are affected by CVE-2024-10011?

It affects 1 product.

Products include Buddypress Buddypress.

How do I fix CVE-2024-10011?

No fix has been published for CVE-2024-10011 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-10011 being exploited?

There is no known exploitation of CVE-2024-10011 in the wild and no public exploit code.

Other vulnerabilities in BuddyPress

• CVE-2021-21389 BuddyPress privilege escalation via REST API High 8.1
• CVE-2020-5244 Private data exposure via REST API in BuddyPress High 8.0
• CVE-2012-2109 SQL injection in n/a High 7.5
• CVE-2025-23798 WordPress Mass Messaging in BuddyPress Plugin <= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerability High 7.1
• CVE-2023-50880 WordPress BuddyPress Plugin <= 11.3.1 is vulnerable to Cross Site Scripting (XSS) Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x369-v24j-6g8p.