The BuddyPress plugin for WordPress contains a deserialization vulnerability in versions up to and including 14.5.0; the bp_unserialize_profile_field() function calls @unserialize() without setting the allowed_classes parameter, allowing authenticated users with subscriber-level or higher access to supply serialized data that is later unserialized, giving them the ability to inject malicious PHP objects. This flaw aligns with CWE‑502 and, if a suitable point‑of‑perception chain exists in the WordPress environment, can be used to achieve remote code execution.

WordPress sites running BuddyPress version 14.5.0 or earlier, where the XProfile feature is enabled and users with subscriber or higher permissions can edit profile fields, are affected.

The CVSS score of 7.5 categorizes the flaw as high severity, while an EPSS score of less than 1% indicates a low probability of exploitation at present; the vulnerability is not listed in the CISA KEV catalog, implying no widespread attacks are known. Exploitation requires authenticated access and a compatible object‑population chain within the WordPress stack, making the threat significant for environments that allow profile field editing but lower for isolated or tightly restricted installations.