tadrik Free store check

Plugin security / BuddyPress

BuddyPress vulnerability: is your WooCommerce store affected?

BuddyPress has 6 serious security holes rated 7 or higher out of 10 that someone can use with no login or with only a customer account. The newest was published on 27 October 2026. Every one is fixed: update to 14.5.3 or newer.

Short answer: your store is affected if it runs BuddyPress older than 14.5.3. Update to 14.5.3 or newer, on a copy of the store first if you can.

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

  1. SQL injection

    Someone could read or change your database, which holds customer and order details.

    Score 8.5 (high)needs only a customer accountAffected: older than 14.5.3Fixed in 14.5.3Published 27 October 2026CVE-2026-111850

    Advisory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2.

  2. SQL injection

    Someone could read or change your database, which holds customer and order details.

    Score 8.5 (high)needs only a customer accountAffected: older than 14.5.3Fixed in 14.5.3Published 26 October 2026CVE-2026-115965

    Advisory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows Blind SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2.

  3. Missing permission check

    An action that should need permission could be done without it.

    Score 7.3 (high)no login neededAffected: older than 14.3.4Fixed in 14.3.4Published 22 January 2026CVE-2024-11976

    Advisory: The The BuddyPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 14.3.3.

  4. Missing permission check

    An action that should need permission could be done without it.

    Score 7.5 (high)no login neededAffected: older than 14.4.0Fixed in 14.4.0Published 27 September 2025CVE-2025-62022

    Advisory: Missing Authorization vulnerability in BuddyPress BuddyPress buddypress.This issue affects BuddyPress: from n/a through <= 14.3.4.

  5. File access

    Someone could read files on your server they should never see.

    Score 8.1 (high)needs only a customer accountAffected: older than 14.2.1Fixed in 14.2.1Published 24 October 2024CVE-2024-10011

    Advisory: The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter.

1 older hole, published before 1 January 2023

  1. Data exposure

    Information meant to stay private could be read.

    Score 7.5 (high)no login neededAffected: older than 5.1.2Fixed in 5.1.2Published 2 January 2020CVE-2020-5244

    Advisory: In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed.

How to check your version

  1. Log in to WordPress and open Plugins > Installed Plugins.
  2. Find BuddyPress. The version number is under its name. If it is lower than 14.5.3, your store is affected.
  3. No login to hand? Open https://yourstore.com/wp-content/plugins/buddypress/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

  1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
  2. On the copy, update BuddyPress to 14.5.3 or newer: Dashboard > Updates, or Update now on the Plugins page.
  3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
  4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use BuddyPress.
  5. If everything works, make the same update on the live store and place one more test order.
  6. If you no longer use BuddyPress, delete it instead of leaving it deactivated.

Not sure, or no time?

Get a free check of your store: we look at its public pages for plugins with known holes, and reply within one working day. Or we fix it for you: we update your store on a copy, place a test order, and only then change the live store, for a fixed £99 / $119.

Free store check Fix it for me on a copy

Questions

Which BuddyPress version fixes it?
Version 14.5.3 or newer fixes all 6 issues on this page.
How do I know if my store is affected?
Your store is affected if it runs BuddyPress older than 14.5.3. In WordPress, open Plugins and read the version under BuddyPress. Without logging in, open yourstore.com/wp-content/plugins/buddypress/readme.txt and read the Stable tag line.
I don't use BuddyPress any more. Is a deactivated copy safe?
Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.
Can someone fix it for me?
Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 5 November 2026.