HexBrain

WordPress · Report #833782

Allow authenticated users can edit, trash,and add new in BuddyPress Emails function

Validstatus
mediumseverity
8upvotes
22 May 2020disclosed

How it was found

Description:

Allow author can edit, trash,and add new your posts in BuddyPress Emails function And editor can edit,trash, add new any posts in BuddyPress Emails default.

Steps To Reproduce:

Step 1 : Create two accounts: Admin and Author Step 2: Login with admin account. In admin account, give author to admin account. Step 4: Login with author within dashboard Access link: domain/wp-admin/edit.php?post_type=bp-email Step 5: Revoke author to author privilege in admin account Step 6: Within author dashboard, author can edit, trash,and add new PoC by video: https://bit.ly/2UH7iLz

Recommendations

Valid user current session access.

Impact

Author can edit, trash,and add new in BuddyPress Emails. And editor can edit,trash, add new any posts in BuddyPress Emails default.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original