BuddyPress 14.4.0 has a regular expression injection vulnerability in its activity mention resolver. When username compatibility mode is enabled, attackers can create @mentions that include regex metacharacters. Because the mention string is passed through esc_sql unescaped and embedded directly into an unprepared REGEXP clause against the users table, the database can be coerced into executing arbitrary regex logic.

The vulnerable product is BuddyPress version 14.4.0, a plugin for WordPress. Any WordPress site that installs BuddyPress 14.4.0 with username compatibility mode active is subject to this flaw; this includes all installations that have not yet applied the fix or subsequent patched releases.

The CVSS score of 7.1 indicates high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting limited documented exploitation. Attackers can reach the vulnerable code by submitting crafted mentions through the normal activity posting interface, which is typically accessible to authenticated users. The impact includes the ability to infer usernames through boolean-based queries and the potential to cause denial of service via catastrophic backtracking of the regular expression engine.