CVE-2026-1360: PHP Object Injection in BuddyPress Leads to RCE

Published on 2 August 2026

If you run a community website, a membership portal or an association site based on WordPress and the BuddyPress plugin, don't sit on your hands this week: On 30 July 2026, the security vulnerability CVE-2026-1360 was made public – a flaw through which logged-in users with the lowest user role could, in the worst case, gain complete control over your server. Affected are all BuddyPress versions up to and including 14.5.0. The good news: an update that fixes the problem is already available.

What happened?

Security researchers have discovered an insecure deserialization of user input in BuddyPress – a popular plugin that extends WordPress websites with social network and community features. The bug lies in the internal function bp_unserialize_profile_field(), which is responsible for processing profile field data.

In concrete terms this means: a logged-in attacker with the most basic privileges (the so-called Subscriber role) can inject manipulated data via the text fields of a user profile. Under certain circumstances this can lead to Remote Code Execution (RCE) – that is, the execution of arbitrary malicious code on the server without the operator noticing a thing.

The vulnerability was discovered by Vincent Theriault-Laine and published via Wordfence as the CVE Numbering Authority. It is rated with a CVSS score of 7.5 (HIGH). According to wordpress.org, BuddyPress has over 90,000 active installations worldwide.

The technical background – explained in plain terms

To put the problem in context, a brief look at two technical terms helps:

Serialization is a process by which PHP – the programming language behind WordPress – converts complex data into a compact text form, in order to store it in a database, for example. Deserialization is the reverse process: usable data objects are reconstructed from the text. The problem: when PHP accepts this text from strangers and converts it back into objects unchecked, an attacker can abuse this process.

That is exactly what happens here. BuddyPress calls the PHP function @unserialize() directly on user-controlled profile data – without the security parameter available since PHP 7.0, allowed_classes => false, which would restrict processing to harmless simple values. The SentinelOne Vulnerability Database describes the cause clearly:

"The root cause is the direct use of @unserialize() on untrusted, user-controllable input without restricting deserialization to safe scalar types via the allowed_classes => false option introduced in PHP 7.0. The @ operator additionally suppresses error output, obscuring exploitation attempts from standard PHP logs."

Particularly insidious: the prefixed @ symbol suppresses error messages in PHP. As a result, attack attempts may not appear in the standard PHP logs at all – a blind spot when it comes to tracing them.

Why not every website is immediately at risk

An important point for context: merely injecting a PHP object does not automatically lead to code execution. That additionally requires a so-called POP chain (Property-Oriented Programming Chain) – a chain of suitable program building blocks (gadgets) that must be present in the WordPress core, in other plugins, or in the theme. Only when such a chain exists can the object injection actually become RCE.

This also explains the CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H: the attack complexity is rated as high (AC:H), because a matching POP chain must be present. Neither the official entries nor the cited sources so far name a concrete, publicly known POP chain for this flaw. The analysts at Fused.com summarise it thus:

"Neither the CNA record nor the cited upstream source identifies a specific usable POP chain, so practical impact is environment-dependent."

In plain terms: The more plugins and themes you have installed, the higher the probability that an exploitable chain exists.

The attack vectors

An attacker can inject the manipulated value in two ways: via the perfectly normal profile edit form (field name field_{field_id}) or via the BuddyPress REST API endpoint /wp-json/buddypress/v1/xprofile/{field_id}/data/{user_id}. BuddyPress stores the value in the database table wp_bp_xprofile_data. When the profile is later displayed, the vulnerable function is called – and the injected object is created.

Who is affected?

This vulnerability is particularly relevant for German SMEs that operate one of the following platforms:

• Community websites and social networks
• Membership portals of associations and organisations
• Club or association sites with user profiles
• Any WordPress site with open user registration and the XProfile component activated

The decisive risk element is open registration: if anyone can create an account, every attacker automatically obtains the Subscriber role needed for the attack – without any invitation at all.

How to check whether you are affected

1. Check the plugin version: In the WordPress dashboard, go to Plugins > Installed Plugins and search for "BuddyPress". Note the version number. Alternatively via WP-CLI (the command-line tool for WordPress): wp plugin get buddypress --field=version
2. Determine whether you're affected: If the version is 14.5.0 or older, your website is potentially vulnerable. Version 14.5.2 is considered secure.
3. Check the XProfile component: Under Settings > BuddyPress > Components, check whether "Extended Profiles" (XProfile) is activated. Only then does the attack surface exist.
4. Check user registration: Under Settings > General, check whether "Anyone can register" is enabled. If so, strangers can create an account.
5. Check the database for signs: Run this query via phpMyAdmin or WP-CLI:
   SELECT id, user_id, field_id, value FROM wp_bp_xprofile_data WHERE value REGEXP '^[aOC]:[0-9]+:';
   Entries that begin with O:, a: or C: could indicate injected serialized objects.
6. Check logs: Inspect the PHP error log and the WordPress activity log for entries containing __wakeup or __destruct. Unexpected new admin accounts or new PHP files under wp-content/uploads/ or wp-content/plugins/ are warning signs of a compromise.

What you need to do now

The most important measure is simple: Update BuddyPress. The current, secure version is 14.5.2, available on wordpress.org.

1. Update immediately: In the WordPress dashboard, update under Plugins > Updates > BuddyPress. Via WP-CLI: wp plugin update buddypress
2. Verify the update: After the update, check the version (wp plugin get buddypress --field=version) and make sure it is 14.5.2 or higher.
3. Temporary measure (if an immediate update isn't possible): Disable XProfile textbox fields or restrict profile editing to trusted roles. Alternatively, temporarily disable user registration (Settings > General – deactivate "Anyone can register").
4. Deploy a WAF rule: Configure a Web Application Firewall (a protective filter placed in front of web applications) to block serialized PHP object signatures (O:, C:) in form fields from non-administrators. Wordfence offers corresponding rules.
5. Harden PHP: In the php.ini, extend the disable_functions setting with dangerous functions such as system, exec and passthru, to limit the impact of a successful POP chain.
6. Review Subscriber accounts: Examine recently registered Subscriber accounts and their profile field inputs for suspicious payloads using the SQL query mentioned above.
7. Remove unneeded plugins: Delete unused or unmaintained plugins and themes – they could provide POP gadget chains.
8. Set up monitoring: Enable activity logging to record profile field changes with user ID and IP address. Watch for sudden spikes in new registrations followed by XProfile REST API traffic.

Putting it in perspective: How acute is the danger really?

As of 2 August 2026, no active exploitation is known – neither the CISA list of Known Exploited Vulnerabilities (KEV) nor the EU-KEV lists CVE-2026-1360. The statistical exploitation probability (EPSS) for the next 30 days is a mere 0.57%.

That is no reason to sound the all-clear, however. The security vendor Patchstack reports in its "State of WordPress Security in 2026" how quickly the tables can turn:

"The weighted median time from public disclosure to mass exploitation was just five hours."

Five hours from disclosure to mass exploitation – for the most heavily attacked vulnerabilities. Add to that the context: in 2025, 11,334 new vulnerabilities were discovered in the WordPress ecosystem (a 42% increase over 2024), 91% of them in plugins. And according to the Verizon DBIR 2026, exploited vulnerabilities became – for the first time in 19 years – the leading initial attack vector in data breaches (31% of all cases).

The risk to your website is therefore medium to high – depending on the configuration. It is increased by open registration, active XProfile textbox fields and many installed plugins. It is mitigated by the high attack complexity and the required authentication.

GDPR: Why this is also a legal matter

BuddyPress websites typically store personal data – names, email addresses, profile details and, in some cases, private messages. If unauthorised access occurs, specific GDPR obligations kick in:

• Notification obligation under Art. 33 GDPR: The competent data protection supervisory authority must be informed without undue delay, ideally within 72 hours of becoming aware. In Germany these are the state data protection authorities.
• Notification obligation under Art. 34 GDPR: Where a high risk is likely, the affected individuals must be informed directly.
• Documentation obligation under Art. 33(5) GDPR: Every data breach must be documented internally – even where no notification obligation applies.

Mario Elsen of the GRC consultancy Elsen GRC nails the crucial point:

"DSGVO-Meldepflicht (Art. 33): Bei einer Verletzung des Schutzes personenbezogener Daten ist die Aufsichtsbehörde in der Regel binnen 72 Stunden zu informieren. Die Uhr läuft ab Kenntnis – nicht ab Behebung. [...] Datenschutzrechtlich bleibt das Unternehmen der Verantwortliche."

Important clarification: the mere existence of a vulnerability does not yet trigger a notification obligation – only an actual unauthorised data access does. But: the technical and organisational measures under Art. 32 GDPR require you to take appropriate security precautions. This includes the timely installation of security updates. Anyone who fails to do so risks fines under Art. 83 GDPR of up to €10 million or 2% of global annual turnover. For context: by January 2025, EU-wide GDPR fines totalled around €5.88 billion.

Conclusion

CVE-2026-1360 is not an acute mass-exploitation panic, but it is a clear call to action. The vulnerability allows authenticated users with minimal privileges to inject PHP objects – and, in the worst case, to fully take over the server. Whether it could go that far in your case depends above all on whether a matching POP chain exists in your plugin and theme landscape. That cannot be reliably judged from the outside – which is why you should not rely on your luck.

The solution is straightforward: Update BuddyPress to version 14.5.2. Additionally, check whether open registration and XProfile textbox fields are active on your site, and take a look at your database and logs. Anyone sharing over 90,000 installations worldwide should not wait to appear in the statistics of successful attacks. With the five-hour median lead time that Patchstack measures for critical flaws, today is the right moment – not next week.