I can't find the description on Spaces anymore

BuddyBoss got hacked.

https://cybernews.com/security/buddyboss-hack-compromises-hundreds-of-websites/

Summary

The XProfile model's user_id is silently overwritten with the auto-increment id after every INSERT. Any subsequent save() on that model instance writes to the wrong user's profile row — corrupting badges, verified status, or any other field.

Root Cause

XProfile.php line 31 declares protected $primaryKey = 'user_id' but leaves $incrementing = true (default). The fcom_xprofile table has a separate auto-increment id column that is NOT user_id.

The framework's insertAndSetId() (Model.php lines 1233-1238) assigns the auto-increment value back to $primaryKey after INSERT:

protected function insertAndSetId(Builder $query, $attributes)
{
    $id = $query->insertGetId($attributes, $keyName = $this->getKeyName());
    $this->setAttribute($keyName, $id);  // sets user_id = auto-increment id
}

After any XProfile creation (new XProfile() + save(), XProfile::create(), or syncXProfile() for a new user), the model instance's user_id is wrong. It contains the table's auto-increment id, not the WordPress user ID that was originally set.

Proof

WP-CLI test:

$xp = new XProfile();
$xp->user_id = 99999;
// ... set other fields ...
$xp->save();

BEFORE save: user_id = 99999
AFTER save:  user_id = 131    ← the auto-increment id, NOT 99999

Real-World Impact: Badge Corruption

We discovered this bug when a FluentCart purchase by a new user corrupted an existing community member's badges. Deterministic pattern across two reproductions:

The victim's user_id always equals the new user's xprofile auto-increment id. The badge write targeted the wrong row because save() generated UPDATE ... WHERE user_id = 129 instead of WHERE user_id = 184.

Affected FluentCart Code

FluentCommunityConnect.php lines 267-275 has the same vulnerability:

$xprofile = $communityUser->syncXProfile(true);  // corrupted user_id on returned model

if ($markAsVerified) {
    $xprofile->is_verified = 1;
    $xprofile->save();  // UPDATE WHERE user_id = [wrong value]
}

If mark_as_verified is enabled on a product's FluentCommunity feed and the purchaser is a new user, is_verified = 1 is written to a random existing member's profile — whoever has user_id equal to the new xprofile's auto-increment id.

FluentCommunity's own syncXProfile() avoids the bug only because it never calls save() on the returned model in the same request. But any caller that does (FluentCart's verified path above, or third-party plugins) will hit it.

Suggested Fix

Set protected $incrementing = false on the XProfile model. user_id is not an auto-increment column — the ORM should not overwrite it after INSERT. This is a one-line fix that protects all current and future callers:

class XProfile extends Model
{
    protected $table = 'fcom_xprofile';
    protected $guarded = ['id'];
    protected $primaryKey = 'user_id';
    protected $incrementing = false;  // ← add this line

Reproduction Steps

1. Note an existing community member whose user_id equals the next fcom_xprofile auto-increment id
2. Create a new user and xprofile (via syncXProfile(), XProfile::create(), or any creation path)
3. Call save() on the returned model (e.g., set is_verified or modify meta)
4. Check the fcom_xprofile table — the existing member's row was modified, not the new user's

Environment

• FluentCommunity 2.3.x
• WordPress 6.7.x, PHP 8.1

I’ve seen how some fluent plugins have a “permissions” or “managers” tab, that have their own capabilities at a user role management. Eg.: fluent forms allows customization from the plugin menu or from the roles capabilities at an admin level. FCRM has some too.

But some other plugins like fluent community, boards and so, I can not clearly see the capabilities at a role level.

Any hint?

Use case: control fluent capabilities at a role level and not at a user level.

the way single vertical pics are portrayed. see screenshot. horizontal pics are filled horizontally. vertical pics should be too.

Hello all, I have two languages already in my community domain.com is first language and domain.com/en/ will be English version, how can make a language switch button or something where user can switch between the two languages easily ?

thanks in advance

Hello all, I updated the plugin to 2.3 and I got this error while trying to open the settings of the new feature :Custom Profile Fields 

So we updated to the latest version, but still have this persistent message on our pages.

Heads UP: FluentCommunityPro Plugin needs to be updated to the latest version. Click here to update.

Never happened any other time, any idea on how to remove it?

How can I set it up so that new members automatically have access to all spaces?

Hello team, kindly help me sort this issue of account authentication codes being invalid during account creation