The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to… (CVE-2026-1360)
The BuddyPress plugin for WordPress versions up to and including 14.5.0 is vulnerable to deserialization of untrusted data. This vulnerability arises from the use of the PHP unserialize function without restricting allowed classes on user-controlled XProfile field data. Authenticated users with subscriber-level access or higher can exploit this to inject arbitrary PHP objects, potentially leading to remote code execution if a suitable gadget chain exists in the environment.
AI Analysis
Technical Summary
CVE-2026-1360 affects the BuddyPress WordPress plugin up to version 14.5.0. The vulnerability is due to the bp_unserialize_profile_field() function using @unserialize() without the allowed_classes parameter on XProfile field data controlled by users. This allows attackers with at least subscriber privileges to inject arbitrary PHP objects. If the WordPress environment contains a suitable POP (Property Oriented Programming) chain, this can lead to remote code execution. The CVSS 3.1 vector rates this vulnerability as high severity with network attack vector, high confidentiality, integrity, and availability impacts, but requiring low privileges and high attack complexity.
Potential Impact
An attacker with subscriber-level access or higher can exploit this vulnerability to inject arbitrary PHP objects via XProfile textbox fields. This may lead to remote code execution if a suitable POP chain is available in the WordPress environment, potentially compromising the confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level users from adding or modifying XProfile textbox fields or disable the BuddyPress plugin if possible. Monitor official BuddyPress channels for updates and apply patches promptly once released.
The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to… (CVE-2026-1360)
Description
The BuddyPress plugin for WordPress versions up to and including 14.5.0 is vulnerable to deserialization of untrusted data. This vulnerability arises from the use of the PHP unserialize function without restricting allowed classes on user-controlled XProfile field data. Authenticated users with subscriber-level access or higher can exploit this to inject arbitrary PHP objects, potentially leading to remote code execution if a suitable gadget chain exists in the environment.
CVSS v3.1
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-1360 affects the BuddyPress WordPress plugin up to version 14.5.0. The vulnerability is due to the bp_unserialize_profile_field() function using @unserialize() without the allowed_classes parameter on XProfile field data controlled by users. This allows attackers with at least subscriber privileges to inject arbitrary PHP objects. If the WordPress environment contains a suitable POP (Property Oriented Programming) chain, this can lead to remote code execution. The CVSS 3.1 vector rates this vulnerability as high severity with network attack vector, high confidentiality, integrity, and availability impacts, but requiring low privileges and high attack complexity.
Potential Impact
An attacker with subscriber-level access or higher can exploit this vulnerability to inject arbitrary PHP objects via XProfile textbox fields. This may lead to remote code execution if a suitable POP chain is available in the WordPress environment, potentially compromising the confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level users from adding or modifying XProfile textbox fields or disable the BuddyPress plugin if possible. Monitor official BuddyPress channels for updates and apply patches promptly once released.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-95g3-wxff-cpfp
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-1360"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6b72cf9c2644c7f84768a8
Added to database: 07/30/2026, 15:50:39 UTC
Last enriched: 07/30/2026, 19:28:19 UTC
Last updated: 07/31/2026, 02:51:59 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.