CVE-2026-39771
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Buddyboss Platform plugin in versions <= 3.1.0 contains an SQL Injection vulnerability exploitable by a subscriber-level user.
Risk Assessment
A subscriber can inject malicious SQL queries, potentially leading to database data leakage or modification.
Recommendation
Update the Buddyboss Platform plugin to a version higher than 3.1.0 or disable it if no update is available.
Other vulnerabilities in Buddyboss Platform
See all- CVE-2026-59514Critical
Buddyboss Platform versions up to 3.0.5 contain an unauthenticated SQL injection vulnerability. An attacker can remotely execute arbitrary SQL queries.
- CVE-2026-56032Critical
The vulnerability in Buddyboss Platform versions up to 3.0.4 allows subscribers to perform PHP object injection. An attacker can exploit this flaw to execute arbitrary code on the server.
- CVE-2026-96554Medium
The BuddyBoss Platform plugin for WordPress (up to and including 3.6.0) is vulnerable to Stored Cross-Site Scripting via Group Name due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access and above can inject arbitrary web scripts into pages that will execute when a user accesses an injected page. This requires the "Enable social group creation by all members" setting to be enabled, which is the default.
- CVE-2026-118082High
Buddyboss Platform plugin versions up to 3.5.0 contain a Subscriber Privilege Escalation vulnerability.
Original NVD description (English source)
Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS