CVE-2026-1360
Deferred Deferred - Pending Action

Deserialization Flaw in BuddyPress Plugin

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: Wordfence

Description
The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the `bp_unserialize_profile_field()` function using `@unserialize()` without the `allowed_classes` parameter on user-controlled XProfile field data. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary PHP objects via XProfile textbox fields, which could lead to remote code execution if a suitable POP chain is available in the WordPress environment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-08-19
AI Q&A
2026-07-30
EPSS Evaluated
2026-08-18
NVD
CVE-2026-1360
EUVD
EUVD-2026-50968

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
buddy_press buddy_press to 14.5.0 (inc)
bp buddy_press to 14.5.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The BuddyPress plugin for WordPress has a vulnerability in versions up to 14.5.0 where the bp_unserialize_profile_field() function uses unserialize() without restricting allowed classes. This allows authenticated attackers with subscriber access or higher to inject malicious PHP objects via XProfile textbox fields. If a suitable POP chain exists in the WordPress environment, this could lead to remote code execution.

Detection Guidance

Check WordPress sites for BuddyPress versions up to 14.5.0. Inspect XProfile textbox fields for unusual serialized data. Review server logs for unserialize() function calls with user-controlled input. Use WordPress plugin scanners to detect vulnerable installations.

Impact Analysis

An attacker could exploit this to execute arbitrary code on your server, potentially taking full control of your WordPress site. They could steal sensitive data, deface your site, or use it as a launchpad for further attacks. The attack requires only subscriber-level access, making it accessible to low-privilege users.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection requirements. For HIPAA, it may compromise protected health information security. Both standards require safeguarding sensitive data, and this flaw could result in non-compliance, legal penalties, and reputational damage.

Mitigation Strategies

Update BuddyPress to the latest version. Disable XProfile textbox fields if not needed. Implement input validation for all user-controlled data. Disable PHP object injection by setting allowed_classes=false in unserialize() calls. Monitor for suspicious activity in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-1360. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart