CVE-2026-53674 Overview
CVE-2026-53674 is a regular expression injection vulnerability in BuddyPress 14.4.0, a popular social networking plugin for WordPress. The flaw resides in the activity mention resolver when username compatibility mode is enabled. Authenticated attackers can submit @mentions containing regex metacharacters that pass through esc_sql unescaped and reach an unprepared REGEXP clause executed against the users table. This enables boolean-based inference of usernames and denial of service through catastrophic backtracking. The weakness is classified under [CWE-943: Improper Neutralization of Special Elements in Data Query Logic].
Critical Impact
Attackers with low-privilege accounts can trigger expensive REGEXP evaluations against the WordPress users table, causing database resource exhaustion and enabling username enumeration via boolean inference.
Affected Products
- BuddyPress 14.4.0
- WordPress sites running BuddyPress with username compatibility mode enabled
- Any deployment exposing the activity mention resolver to authenticated users
Discovery Timeline
- 2026-06-10 - CVE-2026-53674 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-53674
Vulnerability Analysis
BuddyPress resolves @mentions inside activity content by looking up matching accounts in the WordPress users table. When username compatibility mode is enabled, the plugin constructs a database query using the REGEXP operator instead of an exact-match comparison. The mention string is passed through esc_sql, which escapes quotes and backslashes but does not neutralize regular expression metacharacters such as ., *, +, ?, (, ), |, [, and ]. Because the query is not parameterized via wpdb::prepare with a regex-safe binding, attacker-controlled metacharacters become part of the compiled regex evaluated by MySQL.
The vulnerability has two practical consequences. First, an attacker can craft mention patterns that match or fail based on character classes, allowing boolean-based extraction of usernames one character at a time. Second, crafted patterns with nested quantifiers can trigger catastrophic backtracking inside the database engine, exhausting CPU and stalling other queries.
Root Cause
The root cause is mixing input sanitization layers. esc_sql defends against SQL syntax injection but is not a regex escaper. When the sanitized value is concatenated into a REGEXP clause, regex semantics remain attacker-controlled. The plugin does not call a function equivalent to preg_quote before inserting the value, and the query is not bound as a literal parameter.
Attack Vector
Exploitation requires an authenticated account capable of posting activity items containing mentions. The attacker submits activity content with a mention name containing regex metacharacters. The mention resolver issues the malformed REGEXP query against the users table. By observing differences in response, the attacker infers username characters or sustains high-cost regex evaluation to degrade service. No user interaction beyond standard activity posting is required.
No public proof-of-concept code is currently available. Refer to the VulnCheck Advisory for BuddyPress for additional technical context.
Detection Methods for CVE-2026-53674
Indicators of Compromise
- Activity posts containing @mentions with regex metacharacters such as .*, (a+)+, [a-z], or alternation pipes
- Spikes in MySQL CPU usage correlated with BuddyPress activity submissions
- Slow query log entries showing REGEXP clauses against the WordPress users table
- Repeated boolean-style mention submissions from a single account suggesting username enumeration
Detection Strategies
- Inspect the MySQL slow query log for REGEXP queries targeting wp_users originating from BuddyPress mention resolution
- Correlate web access logs for repeated POSTs to BuddyPress activity endpoints with abnormally long response times
- Alert on authenticated users generating bursts of activity items containing non-alphanumeric mention strings
Monitoring Recommendations
- Enable WordPress query logging during incident review to capture mention resolver SQL
- Monitor database CPU and connection count for sustained anomalies during BuddyPress traffic
- Track per-account rates of activity creation to flag scripted enumeration behavior
How to Mitigate CVE-2026-53674
Immediate Actions Required
- Disable username compatibility mode in BuddyPress settings if the workflow does not require it
- Restrict activity posting to trusted user roles until a patched release is deployed
- Review recent activity content for mention strings containing regex metacharacters and investigate the originating accounts
- Apply rate limiting to BuddyPress activity endpoints to slow enumeration attempts
Patch Information
Monitor the WordPress BuddyPress Plugin page and the BuddyPress Official Site for an updated release that addresses the regex injection in the mention resolver. The fix requires escaping regex metacharacters with preg_quote-equivalent logic before the value enters the REGEXP clause, or replacing the REGEXP operator with parameterized LIKE or exact-match queries.
Workarounds
- Switch off username compatibility mode to force exact-match lookups instead of REGEXP evaluation
- Add a web application firewall rule blocking activity submissions whose mention tokens contain regex metacharacters
- Limit BuddyPress activity creation to vetted user roles via capability filters until patched
- Enforce MySQL max_execution_time to cap runaway regex queries
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
