CVE-2026-118082
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Buddyboss Platform plugin versions up to 3.5.0 contain a Subscriber Privilege Escalation vulnerability.
Risk Assessment
A low-privileged user can elevate their privileges, gaining access to features or data reserved for higher roles.
Recommendation
Update the Buddyboss Platform plugin to a version later than 3.5.0. Review user roles and permissions.
Other vulnerabilities in Buddyboss Platform
See all- CVE-2026-59514Critical
Buddyboss Platform versions up to 3.0.5 contain an unauthenticated SQL injection vulnerability. An attacker can remotely execute arbitrary SQL queries.
- CVE-2026-56032Critical
The vulnerability in Buddyboss Platform versions up to 3.0.4 allows subscribers to perform PHP object injection. An attacker can exploit this flaw to execute arbitrary code on the server.
- CVE-2026-96554Medium
The BuddyBoss Platform plugin for WordPress (up to and including 3.6.0) is vulnerable to Stored Cross-Site Scripting via Group Name due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access and above can inject arbitrary web scripts into pages that will execute when a user accesses an injected page. This requires the "Enable social group creation by all members" setting to be enabled, which is the default.
- CVE-2026-39771High
The Buddyboss Platform plugin in versions <= 3.1.0 contains an SQL Injection vulnerability exploitable by a subscriber-level user.
Original NVD description (English source)
Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS