PT-2026-48336 · Buddypress · Buddypress

Published 2026-06-09 · Updated 2026-06-10 · CVE-2026-53674

NVD

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, when username compatibility mode is enabled, allows attackers to manipulate a REGEXP database clause by crafting mention names containing regex metacharacters. Attackers can submit @mentions whose metacharacters pass through esc sql unescaped and are inserted into an unprepared REGEXP query against the users table, enabling boolean-based inference of usernames and denial of service through catastrophic backtracking.

Fix

Weakness Enumeration

CWE-943

Related Identifiers

CVE-2026-53674

Affected Products

Buddypress

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-53674 · Security Note
• https://buddypress.org · Note
• https://vulncheck.com/advisories/buddypress-regexp-injection-via-mention-username-resolution · Note
• https://wordpress.org/plugins/buddypress · Note