CVE-2026-1360

The BuddyPress plugin for WordPress contains a vulnerability that affects all versions up to 14.5.0. The issue arises from the `bp_unserialize_profile_field()` function's use of `@unserialize()` without specifying allowed classes, allowing attackers with subscriber-level access or higher to inject malicious PHP objects into XProfile textbox fields. This could potentially enable remote code execution if a suitable object injection chain is present in the WordPress environment.

Based on public CVE data (MITRE/NVD).