CVE-2026-53674 Details

A regular expression injection vulnerability has been identified in BuddyPress version 14.4.0. This issue arises in the activity mention resolver when username compatibility mode is enabled. The vulnerability allows attackers to manipulate a REGEXP database clause by crafting mention names that include regex metacharacters. These crafted mentions can pass through the esc_sql function unescaped, ultimately being inserted into an unprepared REGEXP query targeting the users table. This exploitation enables boolean-based inference of usernames and could lead to a denial-of-service condition through catastrophic backtracking.