CVE-2026-1360: BuddyPress WordPress Plugin RCE Vulnerability

CVE-2026-1360 Overview

CVE-2026-1360 is an insecure deserialization vulnerability affecting the BuddyPress plugin for WordPress in all versions up to and including 14.5.0. The flaw resides in the bp_unserialize_profile_field() function, which calls PHP's @unserialize() on user-controlled XProfile field data without specifying the allowed_classes parameter. Authenticated attackers with subscriber-level access or above can inject arbitrary PHP objects through XProfile textbox fields. If a suitable Property-Oriented Programming (POP) chain exists in the WordPress environment, the injected objects can lead to remote code execution [CWE-502].

Critical Impact
Authenticated attackers with subscriber-level privileges can inject arbitrary PHP objects, potentially achieving remote code execution when a viable POP chain is present in the WordPress environment.

Affected Products

BuddyPress plugin for WordPress, versions up to and including 14.5.0
WordPress sites exposing XProfile textbox fields via the front-end profile editor
BuddyPress REST API endpoint class-bp-rest-xprofile-fields-endpoint.php

Discovery Timeline

2026-07-30 - CVE-2026-1360 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-1360

Vulnerability Analysis

The vulnerability stems from unsafe PHP object deserialization within BuddyPress XProfile field handling. The bp_unserialize_profile_field() function processes stored profile data by invoking @unserialize() directly on values submitted through XProfile textbox fields. Because the call omits the allowed_classes parameter, PHP will instantiate any class present in the serialized payload and invoke its magic methods such as __wakeup() or __destruct().

Exploitation requires only a subscriber-level account, which is the default self-registration role on many BuddyPress community sites. The attacker submits a crafted serialized string as a profile field value through either the profile edit form or the XProfile REST endpoint at class-bp-rest-xprofile-fields-endpoint.php. When the field is later read and unserialized, the object is instantiated in the WordPress process.

Object instantiation on its own does not guarantee code execution. The attacker must chain the injected object into a Property-Oriented Programming (POP) sequence using gadgets available in WordPress core, other plugins, or themes on the target site. Where such gadgets exist, the primitive escalates to arbitrary file writes, SQL execution, or full remote code execution.

Root Cause

The root cause is the direct use of @unserialize() on untrusted, user-controllable input without restricting deserialization to safe scalar types via the allowed_classes => false option introduced in PHP 7.0. The @ operator additionally suppresses error output, obscuring exploitation attempts from standard PHP logs.

Attack Vector

The attack vector is network-based and requires authentication. An attacker registers a subscriber account, then submits a serialized PHP payload as the value of an XProfile textbox field. The payload can be delivered through the standard profile update workflow or through the BuddyPress REST API. Deserialization occurs when BuddyPress renders profile data via bp-xprofile-template.php, executing any magic methods on the reconstructed object graph. See the Wordfence Vulnerability Analysis and the OWASP PHP Object Injection reference for background on this class of flaw.

Detection Methods for CVE-2026-1360

Indicators of Compromise

XProfile field values in the wp_bp_xprofile_data table that begin with O: or a: followed by class or array serialization markers.
Unexpected subscriber-role registrations followed by immediate profile edits or REST API calls to /wp-json/buddypress/v1/xprofile/fields.
New or modified PHP files under wp-content/uploads/ or wp-content/plugins/ correlated with profile update activity.
PHP error log entries referencing __wakeup, __destruct, or class instantiation from bp_unserialize_profile_field().

Detection Strategies

Inspect HTTP request bodies to profile update and XProfile REST endpoints for serialized PHP payloads matching patterns such as O:\d+:"[A-Za-z_\\]+":\d+:.
Correlate XProfile field writes with subsequent web-shell behaviors: outbound connections from the PHP worker, new administrative users, or unexpected wp_options changes.
Deploy WordPress-aware WAF rules that block serialized object markers in field_* form fields when submitted by low-privilege users.

Monitoring Recommendations

Enable WordPress and BuddyPress activity logging to record profile field changes with the actor user ID and IP address.
Alert on PHP unserialize warnings emitted from the BuddyPress plugin path even though the call uses the @ suppression operator, as some hardened PHP configurations still surface them.
Monitor for spikes in subscriber account registrations followed by XProfile REST API traffic from the same source.

How to Mitigate CVE-2026-1360

Immediate Actions Required

Update the BuddyPress plugin to version 14.5.0 or later on all WordPress installations.
Audit recently registered subscriber accounts and review their XProfile field submissions for serialized payloads.
Restrict new user self-registration temporarily on sites that cannot be patched immediately.
Review installed plugins and themes for known POP gadget chains and remove any that are unmaintained.

Patch Information

BuddyPress 14.5.0 remediates the flaw. See the BuddyPress Version Change Log for the code-level changes to bp-xprofile-functions.php and related files. Administrators should apply the update through the WordPress plugin manager or by deploying the updated plugin package to wp-content/plugins/buddypress/.

Workarounds

Disable XProfile textbox fields, or restrict profile editing to trusted roles, until the patch can be applied.
Deploy a WAF rule that rejects request parameters containing serialized PHP object signatures (O:, C:) from non-administrative users.
Set disable_functions in php.ini to remove dangerous sinks such as system, exec, and passthru to reduce the impact of a successful POP chain.
Apply a temporary must-use plugin that filters XProfile input to block strings matching /^[aOC]:\d+:/ before they reach bp_unserialize_profile_field().

bash

# Update BuddyPress via WP-CLI to the patched release
wp plugin update buddypress --version=14.5.0
wp plugin get buddypress --field=version

# Optional: audit stored XProfile data for serialized objects
wp db query "SELECT id, user_id, field_id, value FROM wp_bp_xprofile_data WHERE value REGEXP '^[aOC]:[0-9]+:';"