Now officially on WordPress.org

CVE Database / CVE-2026-1360

CVE

CVE-2026-1360 — BuddyPress <= 14.5.0 - Subscriber+ PHP Object Injection via XProfile Field Data

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-1360 BuddyPress <= 14.5.0 - Subscriber+ PHP Object Injection via XProfile Field Data — Unknown not specified no fix on file — —

CVE-2026-1360

The BuddyPress plugin for WordPress contains a vulnerability that affects all versions up to 14.5.0. The issue arises from the `bp_unserialize_profile_field()` function's use of `@unserialize()` without specifying allowed classes, allowing attackers with subscriber-level access or higher to inject malicious PHP objects into XProfile textbox fields. This could potentially enable remote code execution if a suitable object injection chain is present in the WordPress environment.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings