PT-2026-66355 · Buddypress · Buddypress

Vincent Theriault-Laine · CVE-2026-1360 · Publicado 2026-07-30 · Atualizado 2026-07-30

NVD

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the bp unserialize profile field() function using @unserialize() without the allowed classes parameter on user-controlled XProfile field data. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary PHP objects via XProfile textbox fields, which could lead to remote code execution if a suitable POP chain is available in the WordPress environment.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2026-1360

Produtos afetados

Buddypress

Referências · 9

• https://plugins.trac.wordpress.org/browser/buddypress/trunk/bp-xprofile/bp-xprofile-template.php#L1000 · Nota
• https://plugins.trac.wordpress.org/changeset?old_path=%2Fbuddypress/tags/14.4.0&new_path=%2Fbuddypress/tags/14.5.0 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1360 · Nota de Segurança
• https://php.net/manual/en/function.unserialize.php · Nota
• https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection · Nota
• https://plugins.trac.wordpress.org/browser/buddypress/tags/14.4.0/bp-xprofile/bp-xprofile-template.php#L1000 · Nota
• https://plugins.trac.wordpress.org/browser/buddypress/trunk/bp-xprofile/classes/class-bp-rest-xprofile-fields-endpoint.php#L866 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/467dd833-2f47-43cd-8d13-dffdad394b3c?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/buddypress/trunk/bp-xprofile/bp-xprofile-functions.php#L519 · Nota