CVE-2026-53674

Name of the Vulnerable Software and Affected Versions BuddyPress version 14.4.0

Description A regular expression injection exists in the activity mention resolver when username compatibility mode is enabled. This allows attackers to manipulate a REGEXP database clause by crafting mention names that contain regex metacharacters. These metacharacters bypass esc sql and are inserted into an unprepared REGEXP query against the users table. This can lead to boolean-based inference of usernames and denial of service through catastrophic backtracking, which occurs when a complex regular expression takes an exponential amount of time to process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.