What is the CVSS score of EUVD-2026-50968?

EUVD-2026-50968 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of BuddyPress are affected by EUVD-2026-50968?

BuddyPress through version 14.5.0 contains a PHP object injection vulnerability in user profile fields exploitable by users with subscriber-level access or higher to execute arbitrary code on…

How to fix or mitigate EUVD-2026-50968?

Within 24 hours, restrict subscriber-level user account creation and profile editing permissions to verified users only, and enable detailed logging on profile field modifications. Within 7 days, since no vendor-released patch is identified at time of analysis, either disable BuddyPress XProfile functionality if not mission-critical or implement strict WAF rules to block PHP object injection patterns in profile submissions; audit and demote unnecessary subscriber accounts to lower privilege levels. Within 30 days, establish a patch management workflow for BuddyPress security advisories and monitor vendor communications for patch availability with commitment to deploy security fixes within 48 hours of release.

BuddyPress EUVD-2026-50968

| CVE-2026-1360 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-30 Wordfence

GHSA-95g3-wxff-cpfp

PHP WordPress RCE Deserialization Buddypress

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable REST/profile input with subscriber login (PR:L); AC:H because code execution requires an available POP gadget chain; full C/I/A impact on successful RCE.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 04:52 vuln.today

CVE Published

Jul 30, 2026 - 04:03 cve.org

HIGH 7.5

DescriptionCVE.org

The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the bp_unserialize_profile_field() function using @unserialize() without the allowed_classes parameter on user-controlled XProfile field data. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary PHP objects via XProfile textbox fields, which could lead to remote code execution if a suitable POP chain is available in the WordPress environment.

AnalysisAI

PHP object injection in the BuddyPress plugin for WordPress (all versions through 14.5.0) allows authenticated users with subscriber-level access or higher to deserialize attacker-controlled data through XProfile textbox fields, which can escalate to remote code execution when a usable POP gadget chain exists in the WordPress stack. The flaw stems from bp_unserialize_profile_field() calling @unserialize() on user-supplied profile data without the allowed_classes safeguard. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the moderate CVSS of 7.5 reflects the dependency on an available gadget chain (high attack complexity).

Technical ContextAI

The vulnerability lives in BuddyPress's XProfile subsystem, which stores extended member profile data. Field values submitted by users (via the profile UI and the REST endpoint class-bp-rest-xprofile-fields-endpoint.php) are passed through bp_unserialize_profile_field() in bp-xprofile-functions.php, which invokes PHP's @unserialize() without setting the allowed_classes parameter. Per CWE-502 (Deserialization of Untrusted Data), calling unserialize() on untrusted input lets an attacker forge serialized PHP object representations; on __wakeup()/__destruct() or other magic-method invocation these instantiated objects trigger a POP (Property-Oriented Programming) chain. The impact therefore depends on classes present in WordPress core, the active theme, or other installed plugins that expose exploitable magic methods (see the referenced OWASP PHP Object Injection and php.net unserialize documentation). The affected component per CPE is cpe:2.3:a:buddypress:buddypress across all versions up to 14.5.0.

RemediationAI

Upgrade BuddyPress to the first release that adds the allowed_classes safeguard to bp_unserialize_profile_field(); because the CVE lists all versions through 14.5.0 as vulnerable, apply the vendor's fixed release above 14.5.0 as published in the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/467dd833-2f47-43cd-8d13-dffdad394b3c?source=cve) - a released patched version is not independently confirmed from the provided data, so verify the exact fix version against the WordPress.org plugin changelog before deploying. As compensating controls until patched, disable open user registration or set the new-user default role so untrusted accounts cannot reach XProfile submission (trade-off: blocks legitimate self-service signup), restrict or disable the BuddyPress XProfile REST endpoint and free-form textbox field types via access controls or a WAF rule inspecting profile-field payloads for serialized-object markers such as 'O:' (trade-off: may break legitimate profile edits and requires tuning to avoid false positives), and audit installed plugins/themes to remove known POP-gadget-bearing code to reduce the chance of a usable chain (trade-off: labor-intensive and not a complete fix).