BuddyPress CVE-2026-53674

Exploitation requires (1) the target site to be running BuddyPress 14.4.0 with the optional 'username compatibility mode' setting enabled - this is the explicit precondition called out in the description and is the primary limiting factor, since sites running the default mode do not reach the vulnerable REGEXP path; (2) an authenticated account with permission to post activity updates containing @mentions (CVSS PR:L), which on community sites with open registration is a trivial barrier but on closed/intranet BuddyPress deployments meaningfully restricts the attacker pool; and (3) the ability to embed regex metacharacters inside the @mention token so they survive esc_sql() and reach the unprepared REGEXP clause. No user interaction by a victim is required (UI:N), and no special platform or client is needed beyond a standard authenticated HTTP session.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H) indicates a network-reachable, low-complexity issue that requires only low-privilege authentication and no user interaction, with low confidentiality impact (username inference) and high availability impact (catastrophic-backtracking DoS against the database). Because BuddyPress activity posting typically requires only a registered community account, the PR:L barrier is very low on public community sites where self-registration is enabled, making this practically reachable. No EPSS score, KEV listing, or SSVC decision was supplied in the input, and no public exploit is identified at time of analysis - so widespread automated exploitation is not yet evidenced. A key conditional limiter is that the vulnerable code path is only reached when the site has 'username compatibility mode' enabled, which is not the default everywhere; defenders should verify that toggle before treating this as an immediate priority. The DoS impact is the most serious operational concern, since catastrophic backtracking inside a database REGEXP can stall worker threads and exhaust connection pools.

An attacker registers (or uses) a low-privileged account on a BuddyPress-powered community site that has username compatibility mode enabled, then posts an activity update containing a crafted @mention whose username portion embeds regex metacharacters - for example, mentions whose body is a boolean-style pattern to infer whether usernames matching a prefix exist (oracle leakage), or a pathological pattern like '(a+)+$' to trigger catastrophic backtracking inside the MySQL REGEXP evaluation. Repeating the DoS payload across several posts can saturate database workers and degrade the entire WordPress site. No public POC has been published in the supplied references.