This CVE reveals a classic SQL Injection flaw in the subscriber handling path of the Buddyboss Platform plugin for WordPress. An attacker who can supply crafted input to the affected endpoint can cause arbitrary SQL statements to be executed against the database. Depending on the database privileges granted to the WordPress user associated with the plugin, this could lead to data exfiltration, credential theft, or full database compromise. The weakness is a classic example of CWE‑89.

The vulnerability applies to all installations of the Buddyboss Platform plugin version 3.1.0 and older. The affected vendor is BuddyBoss via MightyNetworks, and the product is the Buddyboss Platform WordPress plug‑in. No specific patch or version list is provided beyond the cutoff at 3.1.0.

The CVSS score of 8.5 marks it as high severity, and the EPSS score of 0.0029 indicates a very low but measurable exploitation probability; however, the lack of a CISA KEV listing does not reduce concern. The flaw is exploitable remotely through web requests to the subscriber endpoint, meaning an attacker only needs to craft a malicious input via the public interface. Once exploited, the attacker could read confidential data or elevate privileges within the WordPress installation.