🔐 CVE Alert

CVE-2025-14064

MEDIUM 5.4

BuddyTask <= 1.3.0 - Missing Authorization to Authenticated (Subscriber+) Cross-Group Task Board Access and Manipulation

CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th

The BuddyTask plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on multiple AJAX endpoints in all versions up to, and including, 1.3.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view, create, modify, and delete task boards belonging to any BuddyPress group, including private and hidden groups they are not members of.

CWE CWE-862
Vendor cytechltd
Product buddytask
Published Dec 12, 2025
Last Updated Apr 8, 2026
Stay Ahead of the Next One

Get instant alerts for cytechltd buddytask

Be the first to know when new medium vulnerabilities affecting cytechltd buddytask are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability

Affected Versions

cytechltd / BuddyTask
0 ≤ 1.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/0dfe0947-5790-49ba-aa3d-6bc61c12b355?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/buddytask/trunk/buddytask.php#L458 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/buddytask/trunk/buddytask.php#L666 cwe.mitre.org: https://cwe.mitre.org/data/definitions/862.html plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/buddytask/tags/1.3.0/buddytask.php#L458 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/buddytask/trunk/buddytask.php#L763 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/buddytask/trunk/buddytask.php#L840 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3416754/

Credits

Itthidej Aramsri