A SQL Injection vulnerability exists in BuddyPress up to version 14.5.2 due to improper neutralization of special elements in SQL commands. This flaw allows an attacker with low privileges to execute unauthorized SQL queries, potentially causing high confidentiality impact and limited availability impact without user interaction.