CVE-2026-53674: BuddyPress 14.4.0 Regular Expression Injection in Mentions

Technical summary

CVE-2026-53674 is a regular expression injection vulnerability in BuddyPress 14.4.0's activity mention resolver. The vulnerability exists in the username compatibility mode code path, where user-supplied mention names are passed through esc_sql but inserted into an unprepared REGEXP clause targeting the wp_users table. The esc_sql function does not escape regex metacharacters, permitting attackers to inject arbitrary regex patterns. This allows two exploitation vectors: (1) boolean-based blind inference of username existence and content via crafted REGEXP patterns, and (2) denial of service via regex patterns that trigger catastrophic backtracking in the database query engine. The root cause is reliance on string-level escaping for a context requiring regex literal handling.

Business impact

Organizations running BuddyPress 14.4.0 face dual operational risks. The confidentiality impact enables reconnaissance—attackers can enumerate valid usernames and infer details about user accounts without direct enumeration APIs. The availability impact is more immediate: targeted regex patterns can exhaust database CPU and memory, causing site slowdowns or outages that disrupt community functionality and user access. For sites where member privacy and service continuity are critical, this vulnerability merits prompt remediation.

Affected systems

BuddyPress version 14.4.0 is confirmed vulnerable. The flaw activates only when the username compatibility mode setting is enabled in the plugin configuration. Organizations should audit their BuddyPress deployment to confirm both version and whether this feature is active. Earlier and later versions should be verified against vendor advisories, as version-specific vulnerability information is essential for precise scope assessment.

Exploitability

Exploitation requires authentication (PR:L in CVSS context), meaning an attacker must have a valid user account or be able to register one. The attack surface is the activity mention system, a feature typically available on all user roles. No interaction is required beyond submitting a crafted @mention, making automated exploitation straightforward once an account exists. The CVSS score of 7.1 reflects the authentication requirement and the localized impact, but the ease of exploitation and the chaining potential with account enumeration elevate practical risk.

Remediation

Upgrade BuddyPress to a patched version released after June 10, 2026. Verify the specific patch version against the official BuddyPress security advisory to confirm the vulnerability is addressed. As an interim control, disable username compatibility mode if business logic permits, which will prevent the vulnerable code path from executing. Additionally, review database query logs for suspicious REGEXP patterns in mentions to identify reconnaissance or DoS attempts.

Patch guidance

Check the official BuddyPress changelog and security advisories for a release dated after June 10, 2026 that addresses CVE-2026-53674. Apply the patched version in a staging environment and confirm activity mention functionality works correctly before production deployment. If you are on BuddyPress 14.4.0, prioritize patching within the next 5 business days. Verify the specific patch version against vendor documentation before updating, as this intelligence should not be your sole source for version-to-patch mapping.

Detection guidance

Monitor database query logs for REGEXP clauses containing unusual metacharacters (e.g., ., *, +, ^, $, [, ], (, ), {, }) in the context of activity mentions or username lookups. Web application firewalls can be tuned to flag @mention submissions containing regex special characters. Log successful and failed mentions to a central repository; patterns of failed mention attempts with special characters may indicate exploitation reconnaissance. Intrusion detection systems should watch for repeated mention submissions from a single authenticated user.

Why prioritize this

This vulnerability merits high prioritization due to the combination of low authentication friction, practical exploitability for both reconnaissance and denial of service, and direct impact on core BuddyPress functionality. While CVSS 7.1 reflects the authentication gate, the ability to enumerate users and trigger availability incidents in a single-request pattern makes it a credible near-term threat. Sites with public registration or where community trust is essential should treat this as urgent.

Risk score, explained

CVSS 3.1 score of 7.1 (HIGH) reflects: Network-accessible attack vector (AV:N), low attack complexity requiring only crafted mention input (AC:L), mandatory login requirement (PR:L), no user interaction needed (UI:N), single security context (S:U), low confidentiality impact via information disclosure through pattern matching (C:L), no integrity impact (I:N), and high availability impact through DoS (A:H). The score appropriately penalizes the authentication requirement but captures the practical risk of enumeration and service disruption.

Frequently asked questions