Executive brief
BuddyPress, a popular WordPress plugin used to build social networking communities, contains a security flaw in how it handles user profile data. An attacker with a standard user account can submit specially crafted profile information to take control of the website or execute unauthorized commands. This could lead to a total site takeover, theft of member data, or complete service disruption.
Technical details
The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0. The root cause is the `bp_unserialize_profile_field()` function using the PHP `@unserialize()` function on user-controlled XProfile field data without specifying the `allowed_classes` parameter. This lack of restriction allows authenticated attackers with subscriber-level permissions or higher to inject arbitrary PHP objects via XProfile textbox fields. If a suitable Property-Oriented Programming (POP) chain exists within the WordPress environment, this can lead to Remote Code Execution (RCE). The vulnerability was addressed in version 14.5.0 by implementing safer data handling.
Affected products
- BuddyPress BuddyPress up to, and including, 14.5.0
Timeline
- 2026-07-30: advisory: NVD publication date
- 2026-07-30: disclosed: Wordfence disclosure date
References
- https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection
- https://plugins.trac.wordpress.org/browser/buddypress/tags/14.4.0/bp-xprofile/bp-xprofile-template.php
- https://plugins.trac.wordpress.org/browser/buddypress/trunk/bp-xprofile/bp-xprofile-functions.php
- https://plugins.trac.wordpress.org/browser/buddypress/trunk/bp-xprofile/bp-xprofile-template.php
- https://plugins.trac.wordpress.org/browser/buddypress/trunk/bp-xprofile/classes/class-bp-rest-xprofile-fields-endpoint.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fbuddypress/tags/14.4.0&new_path=%2Fbuddypress/tags/14.5.0
- https://www.php.net/manual/en/function.unserialize.php