PT-2026-4326 · WordPress · Buddypress

Michael Mazzolini · Publicado 2026-01-23 · Atualizado 2026-01-28 · CVE-2024-11976

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions BuddyPress plugin for WordPress versions prior to 14.3.4

Description The BuddyPress plugin for WordPress is susceptible to arbitrary shortcode execution. This occurs because the software does not properly validate input before running the do shortcode function. This allows unauthenticated attackers to execute arbitrary shortcodes.

Recommendations Update the BuddyPress plugin to version 14.3.4 or later.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2024-11976

Produtos afetados

Buddypress

Referências · 9

• https://t.me/cveNotify/149653 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/buddypress/tags/14.3.1/bp-templates/bp-nouveau/includes/messages/ajax.php#L232 · Nota
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3259392%40buddypress%2Ftrunk&old=3199645%40buddypress%2Ftrunk&sfp_email=&sfph_mail= · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/34c627c1-7838-468e-acb7-eb84ad1b4949?source=cve · Nota
• https://twitter.com/CVEnew/status/2014706940702527972 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2014609597080715500 · Publicação no Twitter
• https://t.me/CVEtracker/42816 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2024-11976 · Nota de Segurança
• https://twitter.com/cracbot/status/2016466363880284226 · Publicação no Twitter