CVE-2026-115965: SQL Injection in BuddyPress

CVE-2026-115965 is a Blind SQL Injection vulnerability discovered in BuddyPress, the popular community and social networking plugin for WordPress. The flaw allows an attacker to send malicious SQL commands through unsanitized input, potentially accessing sensitive data such as user credentials, private messages, and site configurations, directly impacting data confidentiality and integrity across all vulnerable installations.

The vulnerability is classified with CVSS 8.5 (high severity), confirmed by NVD on October 29, 2026, and affects BuddyPress versions through 14.5.2 (initial version not specified in the official source). Public interest signals were detected on GitHub on November 1, 2026, consistent with the declared severity. The patch status at the time of writing is not officially reported, making continuous verification of official BuddyPress channels critical.

For sysadmins and IT teams: 1) Immediately identify all WordPress installations using BuddyPress and verify their version through admin panels or audit scripts; 2) Continuously monitor official BuddyPress updates and security alerts; 3) Apply security patches as soon as available; 4) In the meantime, evaluate temporary mitigations such as Web Application Firewall rules dedicated to SQL injection detection; 5) Analyze database access logs to identify suspicious activity or potential compromises; 6) Increase monitoring levels on databases containing user credentials.