What’s Vulnerable › Vulnerabilities

CVE-2022-2108: Wbcom Designs – BuddyPress Group Reviews <= 2.8.3 - Unauthorized AJAX Actions due to Nonce Bypass

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-07-18 · updated 2026-06-17
• Weakness: CWE-862

Description

The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due to missing capability checks and improper nonce checks in several functions related to said actions in versions up to, and including, 2.8.3. This makes it possible for unauthenticated attackers to modify reviews and plugin settings on the affected site.

Affected products

• wbcomdesigns Wbcom Designs – BuddyPress Group Reviews: before 2.8.4 — fixed in 2.8.4

How to fix

Upgrade to a fixed version: wbcomdesigns Wbcom Designs – BuddyPress Group Reviews 2.8.4. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/browser/review-buddypress-groups/trunk/includes/bgr-ajax.php#L359
• https://plugins.trac.wordpress.org/changeset/2742109
• https://www.wordfence.com/threat-intel/vulnerabilities/id/397dabc3-5dcf-4d1f-9e24-28af889cb76f?source=cve
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2108
• https://plugins.trac.wordpress.org/browser/review-buddypress-groups/trunk/includes/bgr-ajax.php#L359
• https://plugins.trac.wordpress.org/changeset/2742109
• https://www.wordfence.com/threat-intel/vulnerabilities/id/397dabc3-5dcf-4d1f-9e24-28af889cb76f?source=cve
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2108

Get alerted when CVE-2022-2108 or the next vulnerability affects your stack