CVE-2026-53674 BuddyPress 14.4.0 REGEXP Injection via @Mention Username Resolution
Attackers can inject regex metacharacters into mention queries to infer usernames or cause denial of service when username compatibility mode is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-53674?
CVE-2026-53674 is a high-severity SQL injection vulnerability in BuddyPress, published on 9 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, when username compatibility mode is enabled, allows attackers to manipulate a REGEXP database clause by crafting mention names containing regex metacharacters. Attackers can submit @mentions whose metacharacters pass through esc_sql unescaped and are inserted into an unprepared REGEXP query against the users table, enabling boolean-based inference of usernames and denial of service through catastrophic backtracking.
Weakness: CWE-943
Which versions are affected by CVE-2026-53674?
How do I fix CVE-2026-53674?
No fix has been published for CVE-2026-53674 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-53674 being exploited?
There is no known exploitation of CVE-2026-53674 in the wild and no public exploit code.
Sources
Also known as GHSA-8q4w-j47q-pg4x.