Live › vulnerability › CVE-2026-115965
BuddyPress, a WordPress community plugin, has an SQL injection flaw that lets an attacker run blind SQL queries against the site database. An attacker could read data from the database, such as user records or stored secrets.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 11:24 UTC. All times on this page are UTC.
Sites running the BuddyPress plugin at version 14.5.2 or earlier on WordPress. The description does not say which endpoints or settings are required, so any site with the plugin active should be treated as potentially exposed. Sites that do not run BuddyPress are not affected.
No product ranges from the sources yet.
buddypress.php header14.5.214.5.2 (the sources do not name the exact fixed release)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows Blind SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-115965")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.