Live › vulnerability › CVE-2026-116868
BuddyPress Xprofile Custom Field Types plugin versions 1.3.1 and earlier let a subscriber-level WordPress account inject a PHP object. A successful injection can let an attacker run code or reach data on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Sites running the BuddyPress Xprofile Custom Field Types plugin at version 1.3.1 or earlier, where subscriber accounts can register or log in. The sources do not describe the exact code path, so the unknown parts should be checked against the NVD entry. Sites without the plugin, or running a newer version, are not affected.
No product ranges from the sources yet.
wp plugin get <plugin-slug> --field=version.1.3.1; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-116868")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.