CVE-2026-115965

Name of the Vulnerable Software and Affected Versions BuddyPress versions prior to 14.5.3

Description An issue exists where the software fails to properly neutralize special elements used in SQL commands, leading to Blind SQL Injection. This occurs due to insufficient escaping of user-supplied parameters and a lack of sufficient preparation of the SQL query. Authenticated attackers with subscriber-level access or higher can append additional SQL queries to existing ones to extract sensitive information from the database.

Recommendations Update to a version newer than 14.5.2.