CVE-2026-5144 Details

A privilege escalation vulnerability has been identified in the BuddyPress Groupblog plugin for WordPress, affecting all versions through 1.9.3. The vulnerability arises because the group blog settings handler accepts user input parameters, including 'groupblog-blogid', 'default-member', and 'groupblog-silent-add', without proper authorization checks. This flaw allows any group admin, including Subscribers who create their own groups, to link their group to any blog on the Multisite network, even the main site. Additionally, the 'default-member' parameter can be used to assign any WordPress role, including 'administrator', without validation. When combined with 'groupblog-silent-add', this enables automatic addition of users to the targeted blog with the injected role. As a result, authenticated attackers with Subscriber-level access or higher can escalate any user, including themselves via a second account, to Administrator on the main site of the Multisite network.

Users are advised to update the BuddyPress Groupblog plugin to version 1.9.4 or later, where this vulnerability has been patched.