Version 14.5.4

Versions 11.6.3, 12.7.3, and 14.5.3/14.5.4 are all BuddyPress security releases. They were released on October 22, 2026. 14.5.3 includes several security fixes. 14.5.4 is simply a version bump added to the main SVN trunk to prompt updates, released on October 23.

For Version 14.5.4, the database version (_bp_db_version in wp_options) was 13906, and the Trac revision was 14383.

Security fixes

• Don’t allow users to comment on group-related activity items in groups they are not members of. Special thanks to bisli who first reported this issue.
• Prevent non-admin users from self-assigning member types. Special thanks to jakubk who first reported this issue.
• Prevent SQL blind injection in profile field management. Special thanks to mak3bread who first reported this issue responsibly.
• Prevent SQL injection via unbound argument. Special thanks to a patchstack user who first reported this issue responsibly.
• Prevent exploit of maybe_unserialize() function. Special thanks to a WordFence researcher who first reported this issue responsibly.
• Prevent disclosure of hidden group details via REST API. Special thanks to kasthelord who first reported this issue responsibly.
  

Contributors

Thanks for all of the help with this release! Contributors include bisli, jakubk, mak3bread, kasthelord, dcavins, emaralive, johnjamesjacoby, and espellcaste,