EUVD-2026-48187
GHSA-342m-mgqw-q4m8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network-reachable SQLi (AV:N/AC:L/PR:N/UI:N) reads cross-component DB data giving S:C and C:H; reported vector shows no integrity and only limited availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated SQL Injection in Buddyboss Platform <= 3.0.5 versions.
AnalysisAI
Unauthenticated SQL injection in the BuddyBoss Platform WordPress plugin (versions <= 3.0.5) lets remote attackers inject arbitrary SQL through unsanitized input, exposing database contents without any login. Rated CVSS 9.3 (scope-changed) and reported by Patchstack; no public exploit identified at time of analysis, and it is not listed in CISA KEV. The network-reachable, no-authentication nature makes it a high-priority patch for any site running the community/social-networking plugin.
Technical ContextAI
BuddyBoss Platform is a widely used WordPress plugin that adds community, social-network, and membership features (activity feeds, groups, member profiles, messaging) on top of WordPress. The flaw is a CWE-89 SQL Injection: user-controlled input reaches a database query without proper parameterization or escaping, so an attacker can break out of the intended query and append their own SQL. In the WordPress context this typically means a plugin endpoint (AJAX action, REST route, or query parameter) that passes tainted data into $wpdb without prepare()/sanitization. The CPE cpe:2.3:a:mightynetworks_vs_buddyboss:buddyboss_platform:*:*:*:*:*:*:*:* identifies the affected component as the BuddyBoss Platform plugin across all versions up to and including 3.0.5.
RemediationAI
Upgrade BuddyBoss Platform to the vendor's patched release above 3.0.5 as the primary fix; a specific fixed version number is not provided in the available data, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/buddyboss-platform/vulnerability/wordpress-buddyboss-platform-plugin-3-0-5-sql-injection-vulnerability?_s_id=cve) and the BuddyBoss changelog for the exact release. Until the plugin is updated, deploy a WAF or WordPress virtual patch (Patchstack/Wordfence) with a SQL-injection rule covering the plugin's endpoints, restrict or rate-limit access to the affected AJAX/REST routes, and consider temporarily disabling BuddyBoss Platform on high-exposure sites - noting that disabling it will take down all community features and member-facing pages. Additionally rotate database credentials and audit for anomalous queries or data access if the site has been internet-facing while running <= 3.0.5, since read-oriented SQLi can leak stored credentials.
More in Buddyboss Platform
View allThe BuddyBoss Platform Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including,
The contains an IDOR vulnerability that allows a user to comment on a private post by manipulating the ID included in th
The BuddyBoss Platform plugin and BuddyBoss Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘in
The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bbp_topic_title’ param
The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bp_nouveau_ajax_media_
The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link_title’ parameter
The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view c
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today