CVE-2026-53674: BuddyPress 14.4.0 REGEXP Injection via @Mention Username Resolution

Synopsis

Regular expression injection in BuddyPress 14.4.0 allows an authenticated attacker to manipulate a REGEXP database query through crafted @mention usernames. The vulnerability is reachable over the network and requires only a low-privilege account; no victim interaction is needed. Successful exploitation lets an attacker extract usernames from the users table through boolean-based inference and crash the affected service through catastrophic backtracking in the database engine. HarborGuard is tracking the upstream advisory for patch availability, as no fix version has been published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The mention resolver is exposed over the network, so an attacker must be able to reach the BuddyPress application via HTTP/HTTPS to submit crafted @mention payloads.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker only needs to be logged in as a standard user to submit @mentions through the activity stream.

• Victim interactionNot required

  The injected payload is processed server-side when the mention is submitted; no other user needs to view or click anything for exploitation to succeed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race condition, or environmental precondition beyond submitting a crafted mention string.

Blast Radius

• Reads usernames stored in the WordPress users table through boolean-based blind inference, one character at a time.
• Crashes or severely degrades the database engine by triggering catastrophic backtracking in the REGEXP evaluation, causing denial of service for the affected application.
• Disrupts availability for all users of the BuddyPress instance for the duration of a backtracking-based attack.