BuddyPress plugin: Blind SQL injection

Summary

The WordPress plugin BuddyPress contains a blind SQL injection vulnerability (CWE-89) in versions up to and including 14.5.2. An authenticated attacker with a low-privilege account can inject SQL commands and extract database content, including user accounts and private data, although this is slow and requires many requests. Patchstack rates the issue as high priority with a CVSS score of 8.5, while VulDB gives 6.3; the NVD analysis is still pending.

Affected

• BuddyPress WordPress plugin, versions up to and including 14.5.2 (per Patchstack and VulDB, 14.5.0 to 14.5.2)
• Unknown: whether the 12.x and 11.x branches or older releases are affected

Fixed in

• Update to BuddyPress 14.5.3 or later (Patchstack and OffSeq)
• Vendor security release 14.5.3, 12.7.3 and 11.6.3 announced by BuddyPress.org; the announcement does not name this CVE

Workaround

• Unknown. No vendor-documented workaround found. If an update is not possible immediately, ask your hosting provider or web developer for help; Patchstack reports a mitigation rule for its customers.

Exploitation

• Not known to be exploited (OffSeq); CISA SSVC: exploitation none, automatable no
• No public exploit code found in Metasploit, Exploit-DB or nuclei (OffSeq); VulDB: no exploit available
• Not listed in CISA KEV; EPSS 0.29 %
• Patchstack describes the issue as expected to be exploited; the status may change as the record is only days old

Our recommendation

• Check whether BuddyPress is installed on any client WordPress site and which version is running.
• Update BuddyPress to 14.5.3 or later, and check the 12.x and 11.x branches for their own fixes.
• Restrict open self-registration if it is not needed.
• Review web server and WAF logs for database errors or repeated requests to BuddyPress endpoints.
• Monitor the CVE record and vendor advisories for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  4m3rr0r/CVE-2026-115965

Research sources

• Patchstack advisory patchstack.com
• BuddyPress.org security release 14.5.3, 12.7.3, 11.6.3 buddypress.org
• OffSeq CVE-2026-115965 radar.offseq.com
• VulDB 428359 vuldb.com
• Strix CVE-2026-115965 www.strix.ai
• WPScan BuddyPress wpscan.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:50.