CVE-2026-39771
HighCVSS 8.5Summary
The Buddyboss Platform plugin in versions <= 3.1.0 contains an SQL Injection vulnerability exploitable by a subscriber-level user.
Risk Assessment
A subscriber can inject malicious SQL queries, potentially leading to database data leakage or modification.
Recommendation
Update the Buddyboss Platform plugin to a version higher than 3.1.0 or disable it if no update is available.
Other vulnerabilities in Buddyboss Platform
See all- CVE-2026-59514Critical
Buddyboss Platform versions up to 3.0.5 contain an unauthenticated SQL injection vulnerability. An attacker can remotely execute arbitrary SQL queries.
- CVE-2026-56032Critical
The vulnerability in Buddyboss Platform versions up to 3.0.4 allows subscribers to perform PHP object injection. An attacker can exploit this flaw to execute arbitrary code on the server.
Original NVD description (English source)
Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS