The BuddyPress Docs WordPress plugin before 2.2.5 lacks proper access controls and allows a logged in user to view and download files belonging to another user
CVSS 3.1MEDIUM 4.3·Network·Low privileges·No interaction·EPSS 0.00263·Published 2025-06-27·Fixed in 2.2.5