CVE Intelligence
Analysis AI-assisted

CVE-2026-56032: BuddyBoss Platform PHP Object Injection via Subscriber Role

A PHP Object Injection weakness (CWE-502) in the BuddyBoss Platform WordPress plugin affects versions up to and including 3.0.4, according to the record. Patchstack, the CNA, scored it 9.8 (critical) under CVSS 3.1, but the title-level description names the Subscriber role while the vector lists no privileges required, a point that remains unresolved. No fixed version or structured affected-version list appears in the sources consulted, so site owners should verify their installed version with the vendor or Patchstack.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-56032 is a PHP Object Injection issue (CWE-502, Deserialization of Untrusted Data) in the BuddyBoss Platform plugin for WordPress. The record describes it as affecting versions up to and including 3.0.4. Patchstack is the CNA, and its vulnerability database entry is the main reference in the record.

Impact

  • The recorded CVSS 3.1 base score is 9.8 (critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • That vector indicates a network attack path, low complexity, no privileges required, no user interaction, and high impact to confidentiality, integrity and availability.
  • Deserialization flaws of this class can, in general terms, allow untrusted input to influence application objects. The exact consequences in this plugin are not detailed in the record.

Affected products and versions

  • Product: BuddyBoss Platform (WordPress plugin).
  • Described range: versions up to and including 3.0.4.
  • The structured affected list in the record is empty, so exact boundaries and build identifiers should be confirmed with the vendor or Patchstack.

Exploitation status

The record shows the CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The recorded EPSS probability is 0.00564, with a percentile of 0.45332.

Remediation and mitigation

  • No fixed version is listed in the record. The absence of a listed fix does not mean that no fix exists.
  • Check the installed BuddyBoss Platform version. If it is 3.0.4 or lower, follow vendor or Patchstack guidance for an update once it is available.
  • On sites that do not need open registration, restrict account creation and review user roles and permissions.
  • Keep WordPress core and plugins updated, and remove plugins that are not in use.

Detection guidance

  • Inventory all sites running BuddyBoss Platform and record installed versions.
  • Review web server and application logs for unusual requests to BuddyBoss endpoints, and for unexpected changes to user accounts or site content.
  • Follow the Patchstack database entry for updates.

Limitations of the available information

  • The title field was empty in the source record, so the titles here are derived from the description.
  • The description names the Subscriber role, but the CVSS vector sets privileges required to none (PR:N). This discrepancy is not resolved in the sources consulted.
  • The record contains no fixed version, patch reference, or vendor advisory.
  • Publication and EPSS dates are reproduced as recorded and were not independently verified.

Frequently asked questions

What is CVE-2026-56032?

It is a PHP Object Injection issue (CWE-502) in the BuddyBoss Platform WordPress plugin, described as affecting versions up to and including 3.0.4. Patchstack is the CNA that published the record.

Is this vulnerability known to be exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. Organizations should still treat the critical score seriously and verify their versions.

What should site owners do now?

Check whether BuddyBoss Platform is installed and at version 3.0.4 or lower, follow vendor or Patchstack guidance for updates when available, and review user registration and roles on the site.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.