Version 11.6.3

Versions 11.6.3, 12.7.3, and 14.5.3 are all BuddyPress security releases. They were released on October 22, 2026. 11.6.3 includes several security fixes.

For Version 11.6.3, the database version (_bp_db_version in wp_options) was 13408, and the Trac revision was 14375.

Security fixes

• Don’t allow users to comment on group-related activity items in groups they are not members of. Special thanks to bisli who first reported this issue.
• Prevent non-admin users from self-assigning member types. Special thanks to jakubk who first reported this issue.
• Prevent SQL blind injection in profile field management. Special thanks to mak3bread who first reported this issue responsibly.
• Prevent SQL injection via unbound argument. Special thanks to a patchstack user who first reported this issue responsibly.
• Prevent exploit of maybe_unserialize() function. Special thanks to a WordFence researcher who first reported this issue responsibly.
• Prevent disclosure of hidden group details via REST API. Special thanks to kasthelord who first reported this issue responsibly.
  

Contributors

Thanks for all of the help with this release! Contributors include bisli, jakubk, mak3bread, kasthelord, dcavins, emaralive, johnjamesjacoby, and espellcaste,