What’s Vulnerable › Vulnerabilities

CVE-2025-5526: BuddyPress Docs < 2.2.5 - Subscriber+ Arbitrary Document Read/Update

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-06-27 · updated 2026-06-17

Description

The BuddyPress Docs WordPress plugin before 2.2.5 lacks proper access controls and allows a logged in user to view and download files belonging to another user

Affected products

• boonebgorges BuddyPress Docs: before 2.2.5 — fixed in 2.2.5

How to fix

Upgrade to a fixed version: boonebgorges BuddyPress Docs 2.2.5. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/10196cd3-5bf7-4e40-a4f7-4ff2d34d516d/
• https://wpscan.com/vulnerability/10196cd3-5bf7-4e40-a4f7-4ff2d34d516d/

Get alerted when CVE-2025-5526 or the next vulnerability affects your stack