Plugin inspection:

BP Group Documents

Potentially unsafe

Last revised:

Confidence: Medium
This plugin has been given a short, targeted code review.

Before using this plugin, you should very carefully consider its potential problems and should conduct a thorough assessment. Read more about this recommendation.


This recommendation applies to version 1.2.1 of this plugin, but the most recent version is 1.24. These findings may no longer be correct.


  • Doesn’t escape the “display name” or “description” fields leading to a stored XSS vulnerability
  • Doesn’t check for a nonce when submitting the upload form – this may not be vulnerable because most browsers old enough to not support same-origin policy are too old to support the FormData() and Blob() classes
  • Most SQL is escaped at the point of use, except for a couple of cases where IDs are taken from (apparently safe) WP functions and inserted unescaped, and one case in BP_Group_Documents::get_list_by_group where I’m not sure where the arguments come from
  • There is a vulnerability where an admin user can move any file the PHP user has permission to into the uploads directory, and that form has no CSRF protection on it, include/admin-uploads.php line 120

Reason for the 'Potentially unsafe' result

The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability:

Contains stored XSS vulnerability in the upload form which can be used by any user with an account. Also contains a CSRF vulnerability in the same form which would allow an attacker without a user account to cause a user’s browser to store an XSS attack.

Allows anybody able to make an admin user visit their page to move any file the PHP user has access to into the uploads directory. If an attacker moved the wp-config.php file, for instance, they would cause the site to be completely unavailable and they would then be able to go through the WordPress installation process and configure it to connect to any MySQL server (assuming outbound connections are not blocked).

Failure criteria

  • Execution of unprepared SQL statements
  • Unsafe request processing
  • Unsafe file or network IO
  • Lack of proper output escaping

Read more about our failure criteria.