CVE-2021-21389: 
PHP vulnerability analysis and mitigation

BuddyPress, an open source WordPress plugin for building community sites, was found to contain a critical security vulnerability (CVE-2021-21389) affecting versions from 5.0.0 to 7.2.0. The vulnerability was discovered and privately reported by Kien Hoang to the BuddyPress team, and was patched in version 7.2.1 released on March 16, 2021 (BuddyPress Release, GitHub Advisory).

The vulnerability existed in the BuddyPress REST API members endpoint (buddypress/v1/members/me). The issue received a CVSS v3.1 base score of 8.8 (High) from NVD and 8.1 (High) from GitHub, indicating its serious nature. The vulnerability was classified as an Incorrect Authorization (CWE-863) issue (NVD).

The vulnerability allowed a non-privileged, regular user to obtain administrator rights through the REST API members endpoint. This privilege escalation could give attackers full administrative access to the WordPress site, potentially compromising the entire website's security (GitHub Advisory, WPScan).

The vulnerability could be exploited by any authenticated user with regular user privileges, requiring only access to the REST API members endpoint. The attack vector was network-accessible (CVSS:3.1/AV:N) with low attack complexity (CVSS:3.1/AC:L) (NVD).

The vulnerability was fixed in BuddyPress version 7.2.1. Site administrators running affected versions (5.0.0 to 7.2.0) were strongly encouraged to update to version 7.2.1 immediately. No alternative workarounds were provided, making the update the only reliable mitigation strategy (BuddyPress Release).