CVE-2026-56032: WordPress Buddyboss Platform plugin <= 3.0.4 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection vulnerability in the BuddyBoss Platform WordPress plugin affects all versions up to and including 3.0.4. The vulnerability is reachable over the network with no authentication required and no user interaction needed, making it exploitable by any remote actor who can reach the target site. Successful exploitation allows an attacker to read sensitive data, tamper with application state, and disrupt service availability. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerability is exposed over the network, meaning any unauthenticated actor who can reach the web server can attempt exploitation without local or physical access.

• AuthenticationNot required

  No account or credentials of any privilege level are needed; the attack can be launched anonymously against the public-facing WordPress installation.

• Victim interactionNot required

  No user action such as clicking a link or opening a file is necessary; the attacker initiates the exploit entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions beyond network access.

Blast Radius

• Reads sensitive application data including stored credentials, session tokens, and user records accessible to the WordPress process.
• Modifies or deletes persisted application data including database rows, plugin configuration, and user account details.
• Crashes or destabilizes the affected WordPress service, causing a denial of service for site visitors and administrators.
• Depending on available PHP gadget chains in the environment, arbitrary code execution on the underlying server is achievable.