# Mssing Authorization on Private Message replies (BuddyPress)

BuddyPress messages_send_reply ajax lacks participant check on thread_id, letting any user inject replies into arbitrary private message threads.

- Payout: hidden
- Severity: low
- Program: WordPress
- Found by: klmunday
- Disclosed: 2019-03-08
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/490782
- Library page: https://bugbountylibrary.com/r/h1%3A490782
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:low tech:php tech:wordpress vuln:access-control vuln:idor

**Target:** WordPress admin-ajax.php messages_send_reply action
**Root cause:** The messages_send_reply AJAX handler trusts the client-supplied thread_id without verifying the current user is a participant of that thread.
**Steps:**
1. Log in as any user.
2. Send `POST /wp-admin/admin-ajax.php` with body `action=messages_send_reply&cookie=&_wpnonce=<nonce>&content=Test+Message&thread_id=1`, changing thread_id to target thread.
3. Reply is inserted into the victim's private thread despite attacker not being a participant.
**How found:** Noticed thread_id is a client-controlled parameter in the messages_send_reply AJAX action and tested tampering it to a thread the attacker doesn't belong to.
**Exploitation:** Attacker iterates thread_id from 1 to max index (obtained by creating own thread) posting a message into every private thread; replies appear to participants but not in attacker's sentbox/inbox.
**Escalation:** Combined with other flaws (e.g. #487081) widens attack surface; alone limited to spam/phishing.
**Insight:** In AJAX message/reply handlers, check whether the thread_id parameter is validated against the caller's participant list server-side; sequential thread IDs make mass injection trivial.