CVE-2026-1360
HIGH
7,5
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
Description
AI Translation Available
The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the `bp_unserialize_profile_field()` function using `@unserialize()` without the `allowed_classes` parameter on user-controlled XProfile field data. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary PHP objects via XProfile textbox fields, which could lead to remote code execution if a suitable POP chain is available in the WordPress environment.
502
Deserialization of Untrusted Data
DraftCommon Consequences
Security Scopes Affected:
Integrity
Availability
Other
Potential Impacts:
Modify Application Data
Unexpected State
Dos: Resource Consumption (Cpu)
Varies By Context
Applicable Platforms
Languages:
Java, Ruby, PHP, Python, JavaScript
Technologies:
Not Technology-Specific, ICS/OT, AI/ML
https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection
https://plugins.trac.wordpress.org/browser/buddypress/tags/14.4.0/bp-xprofile/b…
https://plugins.trac.wordpress.org/browser/buddypress/trunk/bp-xprofile/bp-xpro…
https://plugins.trac.wordpress.org/browser/buddypress/trunk/bp-xprofile/bp-xpro…
https://plugins.trac.wordpress.org/browser/buddypress/trunk/bp-xprofile/classes…
https://plugins.trac.wordpress.org/changeset?old_path=%2Fbuddypress/tags/14.4.0…
https://www.php.net/manual/en/function.unserialize.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/467dd833-2f47-43cd-8d…