CVE-2026-111850

CVE-2026-111850 · WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2.

CVSS 8.5 · High · EPSS 0.2% · Fix available

Published: 2026-10-28T13:00:27.940Z
Updated: 2026-10-29T13:47:38.415Z

Affected products and versions

buddypress
Versions
- ≥ 0, ≤ 14.5.2: Affected; ≥ 14.5.3: Not affected (custom)
Update to 14.5.3

Original sources

https://patchstack.com/database/wordpress/plugin/buddypress/vulnerability/wordpress-buddypress-plugin-14-5-2-sql-injection-vulnerability?_s_id=cve
https://nvd.nist.gov/vuln/detail/CVE-2026-111850

Check your server →