CVE-2014-1889

The group creation functionality in BuddyPress versions prior to 1.9.2 contains an authorization bypass that permits authenticated attackers to assume control of any group on the site. This flaw stems from insufficient permission validation during group creation, allowing malicious users to alter group names, descriptions, avatars, and other configuration settings without proper ownership verification.

Based on public CVE data (MITRE/NVD).