CVE-2024-10011

BuddyPress before version 14.2.1 contains a directory traversal vulnerability accessible through the id parameter that allows authenticated users with subscriber privileges or higher to manipulate files beyond their intended scope and upload files to locations outside the web root. The vulnerability could potentially permit attackers to save files with multiple extensions depending on how the server is configured. This flaw impacts all versions up to and including 14.1.0.

Based on public CVE data (MITRE/NVD).