CVE-2025-1909 is a critical (9.8) authentication bypass in the BuddyBoss Platform Pro plugin for WordPress, versions up to and including 2.7.01. The Apple sign in flow does not verify the supplied user well enough. Update to the latest release, at least 2.7.10, and confirm against the vendor notes.
What's affected
The record lists the BuddyBoss Platform Pro plugin for WordPress in versions up to and including 2.7.01. The weakness is CWE-288, authentication bypass using an alternate path or channel. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
The description says there is insufficient verification of the user supplied during the Apple OAuth authenticate request. That makes it possible for unauthenticated attackers to log in as any existing user, such as an administrator, if they have access to the email address of that user.
The record is not on the CISA Known Exploited Vulnerabilities list, and I found no source that says it is exploited in the wild.
Fixed versions: the record links the vendor's 2.7.10 release notes. Those notes, dated 30 April 2025, list a bug entry reading "Fixed Vulnerability issues" and show changes to the Apple provider client file. They do not name the CVE, so confirm with the vendor's advisory or the Wordfence entry linked in the record that 2.7.10 is the first patched build. Using the newest version is the safe choice.
How to check if you're exposed
On a server with WP-CLI, list the plugin and its version.
wp plugin list --fields=name,version,status | grep -i buddyboss
You can also open the Plugins page in the WordPress dashboard and read the version shown for BuddyBoss Platform Pro. Any version up to 2.7.01 is affected.
Then check whether Apple sign in is turned on in the plugin's social login settings. If you have never enabled it, the exposure may be lower, but update anyway because the plugin version is what the record keys on. Review your user list for administrator accounts you do not recognize, and check login history for sign ins that do not match your staff.
What to do now
- Take a backup of the site and the database.
- Update BuddyBoss Platform Pro to the current release, and no lower than 2.7.10.
- If you use Apple sign in, test the flow after the update.
- If you do not use Apple sign in, switch it off in the social login settings.
- Review administrator and editor accounts, and remove any you cannot account for.
- Reset passwords for privileged users and end their active sessions if you see suspicious sign ins.
- Turn on two factor authentication for administrators.
Why it matters
Social login hands the question of who someone is to another service, which answers with a signed token. The site must check that token carefully, including who it was issued for. When the plugin trusts a user value supplied in the request, it asks the visitor to say who they are, and the visitor answers with any name they like.
The report adds one condition, which is knowing the email address of the account. On a membership site, staff and member emails are often public or easy to guess. That makes the condition weak, and it is why an administrator account is the obvious prize. The right posture is to patch quickly and to review accounts afterward.
Quick check
Do I need to update if I never turned on Apple sign in?
Update anyway. The record keys on the plugin version, and a clean settings page is not the same as a patched plugin. Also switch off any social login you do not use.
How do I confirm that 2.7.10 is the first fixed build?
The 2.7.10 release notes mention a vulnerability fix, but not the CVE. Check the vendor's advisory or the Wordfence entry listed in the record, or move to the newest release.
Sources
- BuddyBoss Platform Pro 2.7.10 release notes
- Wordfence entry listed in the record (not retrievable while writing)
Last reviewed: 19 October 2026.
