{"id":"CVE-2026-115965","kind":"vulnerability","aliases":["CVE-2026-115965"],"related":[],"title":"BuddyPress: blind SQL injection exposes site database to attackers","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows Blind SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2.","summary":"BuddyPress, a WordPress community plugin, has an SQL injection flaw that lets an attacker run blind SQL queries against the site database. An attacker could read data from the database, such as user records or stored secrets.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["buddypress","package","self-hosted","wordpress"],"not_affected_if":["buddypress-not-installed"],"how_to_check":"- Check the installed BuddyPress version in the WordPress admin plugins page or the `buddypress.php` header\n- Compare it against the affected range: all versions through `14.5.2`","fix":"- BuddyPress: move to a version later than `14.5.2` (the sources do not name the exact fixed release)","status":"open","published_at":"2026-10-29T11:17:31+00:00","first_seen_at":"2026-10-29T11:24:28+00:00","triaged_at":"2026-10-29T11:25:25+00:00","updated_at":"2026-10-29T11:25:25+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T11:25:25Z","model":"claude-haiku-5-5","output":{"fix":"- BuddyPress: move to a version later than `14.5.2` (the sources do not name the exact fixed release)","reach":"internet","title":"BuddyPress: blind SQL injection exposes site database to attackers","impact":"high","summary":"BuddyPress, a WordPress community plugin, has an SQL injection flaw that lets an attacker run blind SQL queries against the site database. An attacker could read data from the database, such as user records or stored secrets.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","buddypress","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker reads site database contents, including user data","analyst_note":"Confirm the fixed BuddyPress version and whether the injectable endpoint requires login, via the NVD entry and the BuddyPress changelog.","how_to_check":"- Check the installed BuddyPress version in the WordPress admin plugins page or the `buddypress.php` header\n- Compare it against the affected range: all versions through `14.5.2`","plain_action":"","needs_analyst":true,"not_affected_if":["buddypress-not-installed"],"who_is_affected":"Sites running the BuddyPress plugin at version `14.5.2` or earlier on WordPress. The description does not say which endpoints or settings are required, so any site with the plugin active should be treated as potentially exposed. Sites that do not run BuddyPress are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000686,"input_tokens":4120,"output_tokens":547,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115965':12A,15A '-2026':11A,14A '14.5.2':86C 'affect':81C 'allow':76C 'attack':9A,35B,45B 'blind':2A,37B,77C 'buddypress':1A,16B,22B,73C,74C,75C,82C 'command':68C 'communiti':25B 'could':46B 'cve':10A,13A 'data':48B 'databas':7A,43B,51B 'element':63C 'expos':5A 'flaw':31B 'host':20B 'improp':59C 'inject':4A,30B,70C 'injection.this':79C 'issu':80C 'let':33B 'n/a':84C 'neutral':60C 'packag':17B 'plugin':26B 'queri':39B 'read':47B 'record':55B 'run':36B 'secret':58B 'self':19B 'self-host':18B 'site':6A,42B 'special':62C 'sql':3A,29B,38B,67C,69C,78C 'store':57B 'use':64C 'user':54B 'vulner':71C 'wordpress':21B,24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the BuddyPress plugin at version `14.5.2` or earlier on WordPress. The description does not say which endpoints or settings are required, so any site with the plugin active should be treated as potentially exposed. Sites that do not run BuddyPress are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T11:17:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115965","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115965","severity":null,"published_at":"2026-10-29T11:17:31+00:00","modified_at":"2026-10-29T11:17:31+00:00","first_seen_at":"2026-10-29T11:24:28+00:00","fetched_at":"2026-10-29T11:24:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}