PT-2026-66355 · Buddypress · Buddypress

Vincent Theriault-Laine · CVE-2026-1360 · Published 2026-07-30 · Updated 2026-07-30

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the bp unserialize profile field() function using @unserialize() without the allowed classes parameter on user-controlled XProfile field data. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary PHP objects via XProfile textbox fields, which could lead to remote code execution if a suitable POP chain is available in the WordPress environment.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-1360

Affected Products

Buddypress

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-1360 · Security Note
• https://plugins.trac.wordpress.org/browser/buddypress/trunk/bp-xprofile/bp-xprofile-template.php#L1000 · Note
• https://plugins.trac.wordpress.org/changeset?old_path=%2Fbuddypress/tags/14.4.0&new_path=%2Fbuddypress/tags/14.5.0 · Note
• https://php.net/manual/en/function.unserialize.php · Note
• https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection · Note
• https://plugins.trac.wordpress.org/browser/buddypress/tags/14.4.0/bp-xprofile/bp-xprofile-template.php#L1000 · Note
• https://plugins.trac.wordpress.org/browser/buddypress/trunk/bp-xprofile/classes/class-bp-rest-xprofile-fields-endpoint.php#L866 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/467dd833-2f47-43cd-8d13-dffdad394b3c?source=cve · Note
• https://plugins.trac.wordpress.org/browser/buddypress/trunk/bp-xprofile/bp-xprofile-functions.php#L519 · Note