Live › vulnerability › CVE-2026-111850
Go to dashboardBuddyPress, a WordPress community plugin, has an SQL injection flaw in versions through 14.5.2. An attacker can inject SQL into database queries to read or change site data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 13:33 UTC. All times on this page are UTC.
Sites running the BuddyPress plugin at version or earlier on WordPress. The sources do not say which features or settings must be enabled to reach the flawed query, so the exposure of a given site is unknown.
14.5.2No product ranges from the sources yet.
wp plugin get buddypress --field=version14.5.214.5.2 (the sources do not name the fixed release; unknown)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-111850")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.