CVE-2026-53674: BuddyPress 14.4.0 REGEXP Injection via @Mention Username Resolution
BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, when username compatibility mode is enabled, allows attackers to manipulate a REGEXP database clause by crafting mention names containing regex metacharacters. Attackers can submit @mentions whose metacharacters pass through escsql unescaped and are inserted into an unprepared REGEXP query against the users table, enabling boolean-based inference of usernames and denial of service through catastrophic backtracking.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable username compatibility mode (the feature that enables legacy username resolution) to prevent mention names from being interpreted in REGEXP queries.
BuddyPress username compatibility mode = disabled - Configuration
Disable the activity mention resolver / mentions feature if possible until a patch is available, to stop processing @mentions that could trigger REGEXP injection.
BuddyPress (activity mention resolver) enabled = false - Compensating control
Implement input validation or a WAF rule to block or escape @mention values containing regular-expression metacharacters before they reach the application or database (e.g., reject or sanitize characters like . * + ? ^ $ [ ] ( ) { } | \).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53674?
The severity of CVE-2026-53674 is rated high with a score of 7.1.
How do I fix CVE-2026-53674?
To fix CVE-2026-53674, update BuddyPress to version 14.4.1 or later, which addresses the vulnerability.
What does CVE-2026-53674 affect?
CVE-2026-53674 affects BuddyPress version 14.4.0 when username compatibility mode is enabled.
What type of vulnerability is CVE-2026-53674?
CVE-2026-53674 is a regular expression injection vulnerability that allows attackers to manipulate database queries.
What are the potential impacts of CVE-2026-53674?
The potential impacts of CVE-2026-53674 include unauthorized access to sensitive data and possible data corruption due to crafted @mention names.