CVE-2026-59514
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Buddyboss Platform versions up to 3.0.5 contain an unauthenticated SQL injection vulnerability. An attacker can remotely execute arbitrary SQL queries.
Risk Assessment
Risk of unauthorized database access, data theft or manipulation.
Recommendation
Update Buddyboss Platform to the latest version.
Other vulnerabilities in Buddyboss Platform
See all- CVE-2026-56032Critical
The vulnerability in Buddyboss Platform versions up to 3.0.4 allows subscribers to perform PHP object injection. An attacker can exploit this flaw to execute arbitrary code on the server.
- CVE-2026-96554Medium
The BuddyBoss Platform plugin for WordPress (up to and including 3.6.0) is vulnerable to Stored Cross-Site Scripting via Group Name due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access and above can inject arbitrary web scripts into pages that will execute when a user accesses an injected page. This requires the "Enable social group creation by all members" setting to be enabled, which is the default.
- CVE-2026-118082High
Buddyboss Platform plugin versions up to 3.5.0 contain a Subscriber Privilege Escalation vulnerability.
- CVE-2026-39771High
The Buddyboss Platform plugin in versions <= 3.1.0 contains an SQL Injection vulnerability exploitable by a subscriber-level user.
Original NVD description (English source)
Unauthenticated SQL Injection in Buddyboss Platform <= 3.0.5 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS