CVE-2026-115965: WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability

Q: What level of access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges. The attack is network-accessible and does not require user interaction.

Q: What could an attacker gain from successful exploitation?

The vulnerability is rated as having high confidentiality impact, meaning it could expose sensitive information through blind SQL injection. It has no stated integrity impact and a low availability impact.

Published Oct 29, 2026

Updated

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows Blind SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2.

Affected Software

1 affected component

BuddyPress BuddyPress<=14.5.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress BuddyPress plugin to a version that resolves this vulnerability.
Fixed in 14.5.3

Event History

Oct 29, 2026

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges. The attack is network-accessible and does not require user interaction.

What could an attacker gain from successful exploitation?