PT-2026-4326 · WordPress · Buddypress

Michael Mazzolini · Published 2026-01-23 · Updated 2026-01-28 · CVE-2024-11976

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions BuddyPress plugin for WordPress versions prior to 14.3.4

Description The BuddyPress plugin for WordPress is susceptible to arbitrary shortcode execution. This occurs because the software does not properly validate input before running the do shortcode function. This allows unauthenticated attackers to execute arbitrary shortcodes.

Recommendations Update the BuddyPress plugin to version 14.3.4 or later.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-11976

Affected Products

Buddypress

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-11976 · Security Note
• https://t.me/cveNotify/149653 · Telegram Post
• https://plugins.trac.wordpress.org/browser/buddypress/tags/14.3.1/bp-templates/bp-nouveau/includes/messages/ajax.php#L232 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3259392%40buddypress%2Ftrunk&old=3199645%40buddypress%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/34c627c1-7838-468e-acb7-eb84ad1b4949?source=cve · Note
• https://twitter.com/CVEnew/status/2014706940702527972 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2014609597080715500 · Twitter Post
• https://t.me/CVEtracker/42816 · Telegram Post
• https://twitter.com/cracbot/status/2016466363880284226 · Twitter Post