BuddyPress CVE-2026-111850

Exploitation requires an authenticated low-privilege account (CVSS PR:L), which on BuddyPress deployments is commonly satisfied by any registered community member - making open-registration or self-signup sites materially more exposed than sites that restrict account creation. The specific BuddyPress feature, endpoint, or parameter that carries the injection is not described in the available sources, so the precise trigger cannot be stated. Limiting factors: an attacker must first obtain a valid (even minimal) account, and only BuddyPress versions from n/a through 14.5.2 are affected; no user interaction is needed (UI:N) and the vector is network-reachable (AV:N).

This is a credible, above-average-priority issue but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5 High) describes remote, low-complexity exploitation requiring only low-privilege authentication (PR:L) with no user interaction, a scope change (S:C), high confidentiality impact and low availability impact. This profile is consistent with an authenticated SQL injection in a WordPress plugin where any registered member can reach the vulnerable code path. The vuln.today decision label is 'this_week', indicating elevated but non-emergency urgency. No EPSS score, no CISA KEV listing, and no POC/exploit field were supplied, so there is no evidence of active exploitation or weaponization - the signal is severity-driven rather than exploitation-driven. The one reference is the Patchstack advisory that reported the issue, not a published exploit. Net: treat as a genuine priority for BuddyPress-enabled sites that allow open or low-trust registration (where PR:L is trivially satisfied), but the absence of exploitation telemetry (no KEV, no EPSS, no confirmed PoC) argues against emergency out-of-band response. Note the apparent tension that S:C with C:H but I:N/A:L suggests read-oriented database exposure crossing a security boundary; the exact injectable parameter and whether write/modify is possible are not described in the available sources.

An attacker registers or uses an existing low-privilege account on a WordPress site running BuddyPress (<= 14.5.2), then sends a crafted request to a BuddyPress feature that passes attacker input into an SQL query without proper neutralization. The injection lets the attacker read sensitive database contents (e.g., user records and credentials/tokens). No public exploit was identified at time of analysis, and the specific vulnerable endpoint/parameter is not described in the available sources.