BuddyBoss Platform: Subscriber PHP Object Injection (CVE-2026-56032)
NVD has published CVE-2026-56032, a PHP Object Injection vulnerability in the BuddyBoss Platform plugin for WordPress. The CVSS score is 9.8. It can be exploited with Subscriber privileges, i.e. a low-privileged user account.
Checked in Shield: no
Who is affected
WordPress sites with the BuddyBoss Platform plugin installed. The affected version range is not disclosed yet.
How to check
In the WordPress admin, open Plugins and note the BuddyBoss Platform version. Compare it with the NVD entry and vendor notices. Also review whether public registration is open and which accounts have the Subscriber role.
How to fix
No fixed version has been disclosed yet. Watch vendor announcements and install the update as soon as it is released. Remove unneeded Subscriber accounts.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Affected and fixed versions and any exploitation status are not disclosed in the source (NVD).
