BuddyBoss Platform EUVD-2026-48187

The affected site must run BuddyBoss Platform plugin version 3.0.5 or earlier and expose the vulnerable endpoint to the attacker (standard for a public WordPress community site). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required, so exploitation works against default, internet-reachable installations. The primary limiting factor is version: sites already updated past 3.0.5, or with the plugin deactivated, are not exposed; a WAF with SQLi filtering also raises the practical bar. Exact endpoint/parameter prerequisites are not detailed in the available data.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3) describes an easily reached, unauthenticated, no-interaction attack with a scope change and high confidentiality impact - a genuinely serious profile for internet-facing WordPress sites. The scope change (S:C) and C:H indicate the injection can read data beyond the immediately vulnerable component (e.g., the full WordPress database including user hashes), while I:N/A:L suggest the reported vector is read/exfiltration oriented rather than data-destructive. No EPSS score, KEV entry, or POC was provided, so real-world exploitation pressure cannot be quantified from this data; the absence of KEV means it is not confirmed as actively exploited, and no public exploit code was identified. That said, SQL injection in popular WordPress plugins is a heavily automated attack class, so a low or missing EPSS should not be read as low practical risk once details are public. Net: treat as a real, high-priority issue driven by the unauthenticated/network profile rather than by confirmed exploitation.

An unauthenticated attacker sends a crafted HTTP request to a vulnerable BuddyBoss Platform endpoint, embedding SQL metacharacters in a parameter that is concatenated into a database query. Because no authentication or user interaction is required (AC:L, PR:N, UI:N) and scope is changed, the attacker extracts sensitive data such as WordPress user records and password hashes via UNION-based or blind injection. No public proof-of-concept was identified at time of analysis, but the low complexity makes exploitation straightforward once query details are known.