Executive brief
BuddyPress, a popular social networking plugin for WordPress, contains a security flaw in how it handles user mentions (e.g., @username). When a specific compatibility setting is enabled, attackers can use special characters in mentions to probe for private usernames or crash the website's database. This could lead to a loss of privacy for site members or a total service outage for the community platform.
Technical details
A regular expression (regex) injection vulnerability exists in the BuddyPress activity mention resolver component. When 'username compatibility mode' is active, the plugin fails to properly sanitize regex metacharacters in @mentions before they are passed to an 'esc_sql' function and subsequently used in a REGEXP database query. An authenticated attacker can exploit this by crafting mentions that trigger catastrophic backtracking, leading to a Denial of Service (DoS) via database CPU exhaustion. Additionally, the flaw allows for boolean-based inference to discover valid usernames that might otherwise be hidden. The vulnerability is present in version 14.4.0.
Affected products
- BuddyPress BuddyPress 14.4.0
Timeline
- 2026-06-10: disclosed: CVE published to NVD dataset