CVE-2025-1909 Details
Description
The BuddyBoss Platform Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.01. This is due to insufficient verification on the user being supplied during the Apple OAuth authenticate request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
A vulnerability allowing authentication bypass has been identified in the BuddyBoss Platform Pro plugin for WordPress, affecting versions through 2.7.01. The issue arises from inadequate verification of the user information provided during the Apple OAuth authentication process. This flaw enables unauthenticated attackers to log in as any existing user, including administrators, if they have access to the user's email.
Users are advised to update the BuddyBoss Platform Pro plugin to version 2.7.10 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 5, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-Other | Weakness Not in a Standard CWE Category | [email protected] |
| CWE-288 | Authentication Bypass Using an Alternate Path or Channel | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| buddyboss buddyboss platform | < 2.7.10 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2025 | Initial Analysis | [email protected] |
| May 5, 2025 | New CVE Received | [email protected] |