7.5

CVE-2026-1360

BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data

BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data

The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the `bp_unserialize_profile_field()` function using `@unserialize()` without the `allowed_classes` parameter on user-controlled XProfile field data. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary PHP objects via XProfile textbox fields, which could lead to remote code execution if a suitable POP chain is available in the WordPress environment.
Mögliche Gegenmaßnahme
BuddyPress: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerbuddypress
≫
Produkt BuddyPress
Default Statusunaffected
Version <= 14.5.0
Version 0
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt BuddyPress
Version *-14.5.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.57% 0.439
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@wordfence.com 7.5 1.6 5.9
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://www.wordfence.com/threat-intel/vulnerabilities/id/467dd833-2f47-43cd-8d13-dffdad394b3c?source=cve
https://plugins.trac.wordpress.org/browser/buddypress/trunk/bp-xprofile/bp-xprofile-template.php#L1000
https://plugins.trac.wordpress.org/browser/buddypress/tags/14.4.0/bp-xprofile/bp-xprofile-template.php#L1000
https://plugins.trac.wordpress.org/browser/buddypress/trunk/bp-xprofile/classes/class-bp-rest-xprofile-fields-endpoint.php#L866
https://plugins.trac.wordpress.org/browser/buddypress/trunk/bp-xprofile/bp-xprofile-functions.php#L519
https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection
https://www.php.net/manual/en/function.unserialize.php
https://plugins.trac.wordpress.org/changeset?old_path=%2Fbuddypress/tags/14.4.0&new_path=%2Fbuddypress/tags/14.5.0
https://www.wordfence.com/threat-intel/vulnerabilities/id/467dd833-2f47-43cd-8d13-dffdad394b3c
Third Party Advisory