A PHP Object Injection flaw exists in the BuddyPress Xprofile Custom Field Types plugin when subscriber data is passed to an unserialize call without proper validation. This allows an attacker to craft a serialized payload that creates arbitrary objects, which can lead to execution of arbitrary code on the web server. The vulnerability is classified as CWE‑502, an insecure deserialization weakness. Successful exploitation would give the attacker full control over the WordPress site, enabling data tampering, exfiltration, and further lateral attacks.

The flaw affects WordPress installations that have the BuddyPress Xprofile Custom Field Types plugin version 1.3.1 or earlier. BuddyDev delivers the plugin as a BuddyPress extension for managing custom profile fields. Any site running a vulnerable version is at risk; newer releases are presumed to have fixed the unserialize issue.

With a CVSS score of 8.8 the vulnerability is high severity, and while the EPSS score is not available and it is not listed in CISA KEV catalogs, the potential for remote code execution is significant. The likely attack vector is an attacker acting as a subscriber who submits a malicious payload through the plugin’s input interface; because the plugin unserializes this data unchecked, the attacker can instantiate harmful objects and trigger code execution, effectively compromising the WordPress instance.