CVE-2026-56032

Authenticated users with subscriber-level access and above can inject malicious PHP objects into the BuddyBoss Platform plugin for WordPress through versions 3.0.4 and below by exploiting a deserialization vulnerability in untrusted input. This weakness allows potential attackers to introduce arbitrary PHP functionality, which could be leveraged further if additional plugins or themes on the affected site enable exploitation of Object Injection vulnerabilities.

Based on public CVE data (MITRE/NVD).