PHP Object Injection Vulnerability in Buddyboss Platform by WordPress
CVE-2026-56032

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Buddyboss Platform
Vendor
CVE Published:
26 June 2026

What is CVE-2026-56032?

The Buddyboss Platform, specifically in versions up to 3.0.4, is susceptible to a PHP Object Injection vulnerability. This security flaw allows attackers to manipulate PHP objects, potentially leading to unauthorized access or execution of harmful code. Website administrators using affected versions are urged to apply the necessary updates to mitigate this risk and enhance the overall security of their WordPress sites. For further details, consult Patchstack's database.

Affected Version(s)

Buddyboss Platform <= 3.0.4

References

https://patchstack.com/database/wordpress/plugin/buddybos...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dutafi | Patchstack Bug Bounty Program
.