BuddyPress up to 14.4.0 Regular Expression data query logic injection

Summaryinfo

A vulnerability has been found in BuddyPress up to 14.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Regular Expression Handler. This manipulation causes data query logic injection. This vulnerability is handled as CVE-2026-53674. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in BuddyPress up to 14.4.0. It has been declared as critical. Affected by this vulnerability is an unknown part of the component Regular Expression Handler. The manipulation with an unknown input leads to a data query logic injection vulnerability. The CWE definition for the vulnerability is CWE-943. The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, when username compatibility mode is enabled, allows attackers to manipulate a REGEXP database clause by crafting mention names containing regex metacharacters. Attackers can submit @mentions whose metacharacters pass through esc_sql unescaped and are inserted into an unprepared REGEXP query against the users table, enabling boolean-based inference of usernames and denial of service through catastrophic backtracking.

This vulnerability is known as CVE-2026-53674 since 06/10/2026. The exploitation appears to be easy. The attack can be launched remotely. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/10/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• BuddyPress

Version

• 14.0
• 14.1
• 14.2
• 14.3
• 14.4.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion