BuddyBoss Platform CVE-2026-39771

Requires an authenticated low-privilege (subscriber) account on a WordPress site running BuddyBoss Platform version 3.1.0 or earlier (PR:L). The practical prerequisite is that the site permits subscriber-level accounts - BuddyBoss community sites commonly enable open user registration, which makes obtaining the needed privilege trivial. The main limiting factor is this authentication requirement: the flaw is not reachable by a fully unauthenticated visitor, and no user interaction or non-default configuration is otherwise needed. Sites that disable self-registration raise the bar to requiring an existing valid account.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5 High) describes a network-reachable, low-complexity SQL injection requiring only low privileges (PR:L) and no user interaction. Because BuddyBoss is a community/membership platform that routinely allows self-service subscriber registration, PR:L is effectively a very low bar - any registered subscriber can reach the vulnerable code path. The scope-change flag (S:C) with C:H reflects that injected SQL can read data across the WordPress database beyond the attacker's own account. However, no EPSS score, KEV listing, or public POC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis'. This is therefore a genuinely elevated-priority issue for any BuddyBoss site permitting open registration (confidentiality breach by a minimally-privileged user), but there is no evidence of active or automated exploitation, so it ranks below KEV-listed flaws. CWE-89 and the SQLi tag are consistent with the confidentiality-heavy CVSS profile. One caution: the input lists I:N/A:L implying read-only impact, yet SQL injection can often be leveraged for write or DoS depending on query context - treat the no-integrity-impact claim as vendor-asserted rather than independently verified.

An attacker registers (or uses) a low-privilege subscriber account on a BuddyBoss-powered WordPress site and sends a crafted request to the vulnerable plugin endpoint, injecting SQL through an insufficiently sanitized parameter. The malicious query executes against the WordPress database, letting the attacker extract sensitive data such as user records, password hashes, or private community content. No public exploit code was identified in the provided data, but the low attack complexity (AC:L) and subscriber-level privilege requirement make exploitation straightforward for an authenticated user.