CVE-2021-21389

CVE-2021-21389 is a critical privilege escalation vulnerability affecting BuddyPress versions 5.0.0 through 7.2.0. It allows a non-privileged user to gain administrator rights by exploiting an issue in the REST API members endpoint of the WordPress plugin. The vulnerability carries a CVSS score of 8.8 (High), indicating a severe risk. Its attack vector is network-based with low complexity, requiring no user interaction, and can lead to complete compromise of confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, the vulnerability has a high EPSS score of 0.93637, suggesting a high likelihood of exploitation. Publicly available Nuclei templates exist for privilege escalation and potential remote code execution, and it has garnered community discussion, including a Reddit post.