Cyber Resilience

CVE-2026-53674

Public PoC
Published
10 June 2026
Modified
17 June 2026
CVSS Score v4 7.1
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0037 30th percentile
Risk Priority 36 floored blend · peak EPSS

Summary

CVE-2026-53674 is a high-severity Improper Neutralization of Special Elements in Data Query Logic (CWE-943) vulnerability in Buddypress (inferred from references). Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, when username compatibility mode is enabled, allows attackers to manipulate a REGEXP database clause by crafting mention names containing regex metacharacters. Attackers can submit @mentions whose…

more

metacharacters pass through esc_sql unescaped and are inserted into an unprepared REGEXP query against the users table, enabling boolean-based inference of usernames and denial of service through catastrophic backtracking.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-30941Shared CWE-943
CVE-2026-10698Shared CWE-943
CVE-2024-35136Shared CWE-943
CVE-2025-36366Shared CWE-943
CVE-2025-33114Shared CWE-943
CVE-2024-4872Shared CWE-943
CVE-2025-60357Shared CWE-943
CVE-2026-32248Shared CWE-943
CVE-2026-29793Shared CWE-943
CVE-2026-41697Shared CWE-943

Affected Assets

Buddypress
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Input validation directly stops unneutralized special elements from reaching query logic.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require parameterized queries and input neutralization to prevent query-logic injection.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing in development catches injection vulnerabilities before release but does not itself implement the fix.

prevents

Secure development life cycle mandates input validation and query parameterization that directly prevent injection flaws.

prevents

Application security requirements explicitly call for controls against injection and improper query construction.

prevents

Secure architecture principles reduce the likelihood of query-logic flaws but do not prescribe the specific coding practice.

prevents

Secure coding standards require proper neutralization of special elements in all data queries.

prevents

Outsourced development agreements can require secure coding practices, indirectly mitigating the weakness.

References