CVE-2026-53674
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver. When username compatibility mode is enabled, attackers can manipulate a REGEXP database clause by crafting mention names containing regex metacharacters. Metacharacters in @mentions pass through esc_sql unescaped and are inserted into an unprepared REGEXP query, enabling username inference and DoS through catastrophic backtracking.
Risk Assessment
An attacker can leak usernames or cause denial of service by overloading the database, affecting system availability and confidentiality.
Recommendation
Update BuddyPress to a version that includes a fix for this vulnerability, or disable username compatibility mode if possible.
Other vulnerabilities in BuddyPress
See all- CVE-2024-12145Medium
The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bp_notifications_action_bulk_manage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete/mark as read/mark as unread notifications of other users.
- CVE-2026-8155Medium
The BuddyPress WordPress plugin before version 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.
- CVE-2026-1360High
The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in versions up to 14.5.0. The bp_unserialize_profile_field() function uses @unserialize() without the allowed_classes parameter on user-controlled XProfile field data.
- CVE-2026-53675Medium
BuddyPress 14.4.0 has an IDOR vulnerability in the friends REST API allowing an authenticated attacker to enumerate any user's complete friend list. The get_items_permissions_check method only checks if the requester is logged in, not ownership.
- CVE-2026-53673High
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API, allowing authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user's identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused by update and delete handlers, to read, reply to, or delete any user's private messages.
- CVE-2020-37233Medium
WordPress Plugin BuddyPress 6.2.0 contains a persistent cross-site scripting vulnerability allowing authenticated attackers with moderator privileges to inject malicious script code through the figure parameter in wp:html blocks. Attackers can inject iframe elements with event handlers that execute when administrators preview or view the affected page content.
Original NVD description (English source)
BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, when username compatibility mode is enabled, allows attackers to manipulate a REGEXP database clause by crafting mention names containing regex metacharacters. Attackers can submit @mentions whose metacharacters pass through esc_sql unescaped and are inserted into an unprepared REGEXP query against the users table, enabling boolean-based inference of usernames and denial of service through catastrophic backtracking.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS