Plugin inspection:

BuddyPress Activity Plus

Potentially unsafe

Last revised:

Confidence: Medium
This plugin has been given a short, targeted code review.

Before using this plugin, you should very carefully consider its potential problems and should conduct a thorough assessment. Read more about this recommendation.

Warnings

The version of this plugin that this recommendation was based on is known to be vulnerable to attack:

This recommendation applies to version 1.5 of this plugin, but the most recent version is 1.6.3. These findings may no longer be correct.

Findings

  • Allows deleting arbitrary files upon a POST request by any user. This request doesn’t use any kind of CSRF protection so it’s possible for attackers who aren’t users to do it too.
  • No CSRF protection on some POST requests,  which may allow the plugin to be exploitable in other ways.

Reason for the 'Potentially unsafe' result

The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability:

An attacker can delete any file the PHP process can delete.

For this to happen, a logged-in user would have to be tricked into clicking on a link controlled by the attacker. It is easy to make these links very convincin

Failure criteria

  • Unsafe request processing
  • Unsafe file or network IO

Read more about our failure criteria.