CVE-2024-4750: 
WordPress vulnerability analysis and mitigation

The BuddyBoss Platform WordPress plugin before version 2.6.0 contains an Insecure Direct Object Reference (IDOR) vulnerability identified as CVE-2024-4750. This vulnerability was discovered and publicly disclosed on May 14, 2024, affecting the post liking functionality of the plugin (WPScan).

The vulnerability is classified as an Insecure Direct Object Reference (IDOR) with a CVSS score of 4.3 (medium). The vulnerability falls under the OWASP Top 10 category A5: Broken Access Control and is mapped to CWE-639. The issue allows authenticated users to like private posts by manipulating the ID parameter in the request to the wp-admin/admin-ajax.php endpoint (WPScan).

When exploited, this vulnerability allows authenticated users to bypass access controls and interact with private posts that they should not have access to by liking them. This compromises the privacy settings and access control mechanisms of the BuddyBoss Platform (WPScan).

The vulnerability can be exploited by sending a POST request to the wp-admin/admin-ajax.php endpoint with a manipulated ID parameter in the request body. The exploit requires authentication but can be executed by any authenticated user regardless of their privilege level (WPScan).

The vulnerability has been fixed in BuddyBoss Platform version 2.6.0. Users are advised to update to this version or later to mitigate the security risk (WPScan).