BuddyPress Xprofile Custom Field Types: PHP Object Injection by Subscribers

Summary

The WordPress plugin BuddyPress Xprofile Custom Field Types up to and including version 1.3.1 contains a PHP object injection vulnerability (CWE-502). An attacker with a Subscriber account can manipulate serialized data so that the server processes it as PHP objects, which may allow code execution, data access or denial of service. Exploitation requires a logged-in low-privilege account, so sites with open registration are most exposed. No vendor fix was found at the time of writing.

Affected

• BuddyDev BuddyPress Xprofile Custom Field Types, all versions up to and including 1.3.1
• Attack requires a Subscriber-level account

Fixed in

Unknown. No fixed version or vendor advisory was found.

Workaround

• No vendor workaround found.
• Deactivate and remove the plugin if its field types are not needed.
• If it is needed, restrict or disable open user registration.
• Check for virtual patching from Patchstack or another provider if available.

Exploitation

• CISA SSVC: Exploitation none, not automatable.
• VulDB and OffSeq report no known public exploit or PoC as of 29 Oct 2026.
• Patchstack rates the issue high priority and expects exploitation; this is not confirmed by observed attacks.
• EPSS: 0.45 %.

Our recommendation

• Check whether the plugin is installed on your WordPress sites.
• If it is not needed, deactivate and remove it.
• If it is needed, disable open registration and review Subscriber accounts for unexpected entries.
• Apply virtual patching if you have a subscription, and monitor for a vendor fix.
• Keep WordPress and PHP up to date.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• VulDB entry vuldb.com
• OffSeq threat radar radar.offseq.com
• Strix CVE page www.strix.ai
• BuddyDev plugin page buddydev.com
• WordPress.org plugin page wordpress.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:11.