Version 5.2.0

Version 5.2.0 is a BuddyPress security and maintenance release. It was released on April 21, 2020. Four vulnerabilities were addressed, and five bugs fixed.

For version 5.2.0, the database version (bp_db_version in wp_options) was 12385, and the Trac revision was 12512.

Fixes

• Security: A vulnerability was fixed that could allow group moderators improper control over group membership via a REST API endpoint.
• Security: A vulnerability was fixed that could allow a CSRF attack related to xProfile field deletion links in the Dashboard.
• Security: A vulnerability was fixed that could allow users to delete group activity items belonging to groups to which they don’t have administrative access.
• Security: A vulnerability was fixed that could allow site Editors or Authors improper edit access over items belonging to BuddyPress’s Email post type.
• Groups: Fixed a PHP notice when adding a user to a group via the REST API.
• Groups: Fixed a string in the Group Members administration UI that was not properly localizable.
• Groups: Fixed a bug that could cause pending invitations to be properly resent in some cases.
• Build: Improved Travis configuration.
• Members: Improved compatibility with WordPress 5.4’s updated user data tools.