CVE-2026-1360
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in versions up to 14.5.0. The bp_unserialize_profile_field() function uses @unserialize() without the allowed_classes parameter on user-controlled XProfile field data.
Risk Assessment
An authenticated attacker with subscriber-level access or above can inject arbitrary PHP objects, potentially leading to remote code execution if a suitable POP chain is available.
Recommendation
Update the BuddyPress plugin to the latest version. Restrict user privileges to the minimum necessary.
Other vulnerabilities in BuddyPress
See all- CVE-2026-8155Medium
The BuddyPress WordPress plugin before version 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.
- CVE-2026-53675Medium
BuddyPress 14.4.0 has an IDOR vulnerability in the friends REST API allowing an authenticated attacker to enumerate any user's complete friend list. The get_items_permissions_check method only checks if the requester is logged in, not ownership.
- CVE-2026-53674High
BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver. When username compatibility mode is enabled, attackers can manipulate a REGEXP database clause by crafting mention names containing regex metacharacters. Metacharacters in @mentions pass through esc_sql unescaped and are inserted into an unprepared REGEXP query, enabling username inference and DoS through catastrophic backtracking.
- CVE-2026-53673High
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API, allowing authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user's identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused by update and delete handlers, to read, reply to, or delete any user's private messages.
Original NVD description (English source)
The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the `bp_unserialize_profile_field()` function using `@unserialize()` without the `allowed_classes` parameter on user-controlled XProfile field data. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary PHP objects via XProfile textbox fields, which could lead to remote code execution if a suitable POP chain is available in the WordPress environment.