CVE-2026-111850: WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability

Q: Which deployments are affected?

BuddyPress versions through 14.5.2 are affected. The available data does not specify an earlier unaffected version boundary.

Q: What does an attacker need to exploit this issue?

The CVSS vector indicates network reachability and low privileges are required. No user interaction is required.

Q: What is the likely security impact?

The issue is rated high severity with a CVSS score of 8.5. The vector indicates high confidentiality impact, low availability impact, no integrity impact, and a changed scope.

Published Oct 28, 2026

Updated

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2.

Affected Software

1 affected component

BuddyPress BuddyPress<=14.5.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress BuddyPress plugin to a version that resolves this vulnerability.
Fixed in 14.5.3

Event History

Oct 28, 2026

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

BuddyPress versions through 14.5.2 are affected. The available data does not specify an earlier unaffected version boundary.

What does an attacker need to exploit this issue?

The CVSS vector indicates network reachability and low privileges are required. No user interaction is required.

What is the likely security impact?

The issue is rated high severity with a CVSS score of 8.5. The vector indicates high confidentiality impact, low availability impact, no integrity impact, and a changed scope.

CVE-2026-111850: WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the likely security impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the likely security impact?