Buddyboss Platform: SQL injection by authenticated subscribers
Summary
BuddyBoss Platform, a WordPress plugin for community and membership sites, contains an SQL injection vulnerability in versions up to and including 3.1.0. An attacker with a Subscriber account can inject SQL statements to read, modify or delete database content, including user accounts and private data. The attacker needs a logged-in account, which is WordPress's default role for self-registered users, so sites with open registration are most exposed.
Affected
- BuddyBoss Platform up to and including 3.1.0 (CVE record)
- Patchstack lists versions below 3.6.0 as vulnerable
- Vendor version range: not confirmed by BuddyBoss
Fixed in
- Patchstack lists 3.6.0 as the patched version
- BuddyBoss has not confirmed a fixed version or release date in the sources reviewed
- Do not assume that 3.1.0 or the fix for CVE-2026-59514 resolves this issue
Workaround
Unknown. No vendor or Patchstack workaround was found in the sources reviewed. Patchstack has issued a mitigation rule for its customers.
Exploitation
- Not marked as known exploited (CISA KEV: No)
- No public proof of concept found in the sources reviewed
- CISA SSVC: exploitation none, automatable no
- Patchstack rates it as high priority and expects exploitation in mass campaigns
Our recommendation
- Check whether BuddyBoss Platform is installed and which version is running.
- Update to the latest version and confirm the fixed build in the BuddyBoss release notes or the Patchstack advisory.
- Disable open user registration or approve new accounts manually.
- Review all subscriber accounts and remove unknown or dormant ones.
- Use a web application firewall or virtual patch in front of the site if available.
- Keep a current database backup and monitor for unexpected database errors or changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory for CVE-2026-39771 patchstack.com
- HOL Guard entry for CVE-2026-39771 hol.org
- Strix CVE record for CVE-2026-39771 www.strix.ai
- OffSeq radar entry for CVE-2026-39771 radar.offseq.com
- Qualys application security detections, October 2026 notifications.qualys.com
- BuddyBoss 3.0 changelog FAQ buddyboss.com
- BuddyBoss Platform releases on GitHub github.com
- BuddyBoss Platform add-on wiki on GitHub github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:23.
Original description (NVD)
Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.