Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, when username compatibility mode is enabled, allows attackers to manipulate a REGEXP database clause by crafting mention names containing regex metacharacters. Attackers can submit @mentions whose metacharacters pass through esc_sql unescaped and are inserted into an unprepared REGEXP query against the users table, enabling boolean-based inference of usernames and denial of service through catastrophic backtracking.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-53674 Regular Expression Injection in BuddyPress 14.4.0 Activity Mention Resolver https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-53674
Post summary
The post announces a new vulnerability (Regular Expression Injection) affecting BuddyPress 14.4.0, with no evidence of PoC, exploit availability, active usage, or mitigation advice.