shouldiuse.io

Categories

VERDICT

BuddyBoss Review

Depends

Should I use BuddyBoss?

Create an online school with everything you need to provide a powerful learning experience for your students. - buddyboss.com

· 1 month ago

Buy if you run a serious course or paid community and are comfortable owning WordPress hosting and patching. Skip if you want zero-maintenance hosting or can't stomach its CVE history and reported surprise renewals.

Confidence

Medium. Based on 25+ public sources; many snippets were truncated, limiting verbatim detail.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support quality
  • Security posture

Pricing

$349/yr

BuddyBoss Plus

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
All-in-One BundleNot shown in sources

Best for

  • Course creators selling programs
  • Paid membership communities
  • WordPress-based businesses
  • Coaches wanting branded mobile apps

Not for

  • Anyone unwilling to run and patch WordPress hosting
  • Teams nervous about payment data after the 309-site breach
  • Budget-sensitive solo creators — renewals jump
  • People wanting a hosted, zero-setup platform

Gotchas - check before you buy

high

Renewal trap: one user hit a $465 surprise renewal with refund refused

high

Active exploitation observed in the wild; patch security releases immediately

medium

Self-hosted: you own hosting, backups, and emergency security patching

medium

Scalability under many concurrent users is unproven; load-test before launch

Pros and cons

Pros

  • All-in-one: community, courses, memberships on WordPress
  • Native mobile app available
  • Used by 50,000+ communities
  • Strong ratings: 4.7/5 Trustpilot, 5.0/5 WPBeginner
  • Integrates with LearnDash and membership plugins

Cons

  • Multiple CVEs including auth bypass and potential RCE
  • Real attack compromised 309+ sites; Stripe keys stolen
  • Surprise $465 renewal reported; refund refused
  • Self-hosted WordPress: you manage hosting, updates, backups
  • Performance questions at high concurrent users

Sources & method

- 13 sources - Concerning record: multiple CVEs plus a live attack breaching 309+ sites and stealing Stripe keys.

official x2review x5security x4news x2
  • 309+ sites compromised, Stripe keys stolen, Ongoing attack against live BuddyBoss servers compromised hundreds of websites and exfiltrated Stripe API keys.
  • CVE-2026-56032 — PHP object injection, PHP object injection flaw in BuddyBoss Platform with potential for remote code execution.
  • CVE-2025-1909 — authentication bypass, Authentication bypass vulnerability in the BuddyBoss Platform plugin.
  • Stored XSS via invitee name, Authenticated (Subscriber+) stored cross-site scripting in BuddyBoss Platform Pro.

Key stats

  • Value for money: 3/5

    Rating

  • $349/yr

    Starting price

  • 13

    Sources

  • Analyzed

  • Value for money: 3/5. Strong feature bundle, but renewal jumps sting
  • Ease of use: 3/5. Capable, but WordPress setup isn't beginner-easy
  • Feature depth: 5/5. Community, courses, memberships, mobile app bundled
  • Support quality: 3/5. 4.7 Trustpilot, but refund disputes reported
  • Security posture: 1/5. Auth bypass, RCE CVE, 309+ sites breached
  • 4.7/5 Trustpilot rating 900 reviews
  • 5.0/5 WPBeginner rating 961 reviews
  • $349/yr Plus plan price renewals reported at $465
  • 50,000+ Scale communities built

Pricing

BuddyBoss Plus

$349/yr

  • Community plus courses
  • For communities that scale

All-in-One Bundle

Not shown in sources

  • Theme, Platform Pro, extras bundled
  • One licence covers products

Security

Concerning record: multiple CVEs plus a live attack breaching 309+ sites and stealing Stripe keys.

  • 309+ sites compromised, Stripe keys stolenOngoing attack against live BuddyBoss servers compromised hundreds of websites and exfiltrated Stripe API keys.⁸
  • CVE-2026-56032 — PHP object injectionPHP object injection flaw in BuddyBoss Platform with potential for remote code execution.10
  • CVE-2025-1909 — authentication bypassAuthentication bypass vulnerability in the BuddyBoss Platform plugin.⁹
  • Stored XSS via invitee nameAuthenticated (Subscriber+) stored cross-site scripting in BuddyBoss Platform Pro.

What users say

Ratings are strong (4.7 Trustpilot, 5.0 WPBeginner), but Reddit threads flag surprise renewals and concurrency doubts.

“BuddyBoss just hit me with a $465 “surprise renewal””
Reddit, r/Wordpress
“BuddyBoss is an amazing”
Reddit, r/WordpressPlugins
Full analysis

Based on 25+ public sources; many snippets were truncated, limiting verbatim detail.

Powerful WordPress community+courses platform, but real breach history, CVEs, renewal traps, and self-hosting burden.

Methodology

Based on 25+ public sources; many snippets were truncated, limiting verbatim detail.

Read how a report is made.

Sources

  1. BuddyBoss Trustpilot reviewstrustpilot.com
    review
  2. WPBeginner BuddyBoss reviewwpbeginner.com
    review
  3. BuddyBoss Capterra reviewscapterra.com
    review
  4. Reddit: $465 surprise renewalreddit.com
    review
  5. Reddit: concurrent users questionreddit.com
    review
  6. BuddyBoss pricing pagebuddyboss.com
    official
  7. Introducing BuddyBoss Plusbuddyboss.com
    official
  8. Cybernews: 309+ sites hacked, Stripe keys stolencybernews.com
    security
  9. NVD: CVE-2025-1909 auth bypassnvd.nist.gov
    security
  10. CVE-2026-56032 PHP object injectionionix.io
    security
  11. WPScan: BuddyBoss plugin vulnerabilitieswpscan.com
    security
  12. Getlatka: $7.9M est. ARRgetlatka.com
    news
  13. PR Newswire: Awesome Motive fund acquires BuddyBossprnewswire.com
    news

Add this review to your site

This check for BuddyBoss says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends BuddyBoss Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.