CVE-2026-1360: BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data
The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the bpunserializeprofilefield() function using @unserialize() without the allowedclasses parameter on user-controlled XProfile field data. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary PHP objects via XProfile textbox fields, which could lead to remote code execution if a suitable POP chain is available in the WordPress environment.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1360?
The severity of CVE-2026-1360 is classified as high with a CVSS score of 7.5.
How do I fix CVE-2026-1360?
To fix CVE-2026-1360, update the BuddyPress plugin to version 14.6.0 or higher.
What type of vulnerability is CVE-2026-1360?
CVE-2026-1360 is a PHP Object Injection vulnerability due to deserialization of untrusted data.
Who is affected by CVE-2026-1360?
All users of BuddyPress versions up to and including 14.5.0 are affected by CVE-2026-1360.
What impact does CVE-2026-1360 have on my website?
CVE-2026-1360 can lead to remote code execution and unauthorized access to sensitive data.