A BuddyBoss update is out. Do you install it today?
Some updates close a security hole. Others move features your members use. Here’s how to tell which one you’re looking at, using the current release as the example.
Danica LouweUpdated 5 min readUsually yes, but check one thing first. BuddyBoss 3.7.1 has a security fix, so don’t leave it for long. Since 3.7.0, though, videos, documents and group subscriptions live in a separate Add-ons plugin, and without it, those features vanished for members on our test site.
What changed in the latest releases
3.7.1, 5 November 2026: a security fix
It fixes a security issue with comments on private and hidden group posts. It also fixes a slowdown from activity drafts, restores background cleanup, and fixes large video uploads on sites behind Cloudflare.
3.7.0, 29 October 2026: features moved
Videos, documents, animated GIFs and group subscriptions moved out of BuddyBoss Platform and into the separate BuddyBoss Add-ons plugin. BuddyBoss says existing customers keep access.
3.6.2, 22 October 2026: tighter permissions
Stronger permission checks for media previews, video thumbnails, invites, drafts and private messages. If you’re still on an older version, this one matters too.
Who it affects, and how fast to move
You have private or hidden groups
The security fix in 3.7.1 is about comments in those groups. Test it today and install it as soon as the test passes.
Members post videos or documents, or you sell group subscriptions
Sort out the Add-ons plugin first. Without it, those features disappear for your members.
Neither of those
Treat it as a normal update: take a backup, install it when you can watch the site, and click around as a member afterwards.
What to test before it reaches members
- 1
Read every note since your version
Find your version on the Plugins page, then open each release newer than it. A move like the one in 3.7.0 is easy to miss if you only read the latest note.
- 2
Check you have Add-ons, if you need it
See whether it’s on your Plugins page, and whether your BuddyBoss account includes it. If your site updates plugins by itself, this may have already happened, so look now.
- 3
Back up, then update a copy of the site
Use a staging copy if your host offers one. Your test matters more if the copy has real content on it.
- 4
Log in as a member, not as yourself
Our test site looked fine from the outside. The gaps only showed up when we looked for what a member expects to find.
- 5
Update the live site, then look again
Do it when you can watch the site, and read the notices on the Plugins page straight after.
On the copy, as a member, check that:
- A profile still has its Videos and Documents tabs, if you use them
- An old feed post with a document still shows the document
- A member can upload a new video and a new document
- A member in a private group can read and add comments, and a non-member can’t see them
- Group subscriptions still work, if you sell them
- Login, a course lesson and a private message all still work
What the notes don’t say
- What members see if Add-ons is missing. The notes say the features moved and customers keep access. They don’t describe the empty pages and missing tabs.
- Which releases are security releases. The main releases page doesn’t mark them, so you have to open each note.
- What happens if the automatic install fails. The plugin’s code tries to install Add-ons on licensed sites whose plan includes it. If the download fails, it carries on without showing an error at that step.
What we saw on a test site
We built a test site on BuddyBoss Platform 3.5.1 and had a member upload one document and one video. Then we replaced the plugin with 3.7.0 and left Add-ons out, which is what a site gets if the automatic install doesn’t happen.
What members saw
The Videos and Documents tabs were gone from profiles and those profile pages gave a 404. The Documents page showed only its heading, with nothing under it. The document attached to an old feed post was gone, though the post’s text stayed. Nothing explained why.
What the site did
No crash and no critical error. On the Plugins page, an admin notice said how many videos, documents and group subscriptions were hidden, and to install Add-ons. Members never see that notice.
What was kept
The database records and the uploaded files were all still there.
What brought it back
We installed and activated BuddyBoss Add-ons 1.3.1. The tabs, pages and uploads came back, and the notice went away, with no other steps.
What this test doesn’t cover
- It ran on 3.7.0, not 3.7.1, so we haven’t tested the security fix itself.
- The site had no licence, so the automatic install never ran. A licensed site may never see any of this.
- We replaced the plugin files by command, not with the Update button in the dashboard.
- It’s a small test site, not a community with years of uploads, and we didn’t try buying a group subscription.
Questions owners ask
My videos and documents disappeared after a BuddyBoss update. How do I get them back?
Look on your Plugins page for the BuddyBoss Add-ons plugin. Since version 3.7.0, those features live there. On our test site, installing and activating it brought back the videos, documents and profile tabs with no other steps.
Does the update delete my members’ videos and documents?
Not in our test. With Add-ons missing, the database records and the uploaded files were still there, only hidden. Keep a backup before you update anyway, since we tested one document and one video, not a full library.
Do I need to pay for the Add-ons plugin?
BuddyBoss says existing customers keep access, and the notice in the plugin says Add-ons is available on the Start plan and above. Check your own account before you update, because we can’t see which plan you’re on.
Will Add-ons install by itself?
It should on a site with an active licence and a plan that includes it. The plugin’s code tries to install it during the update. If that download fails, the code carries on without an error, so check the Plugins page afterwards. We didn’t test this path.
Can I skip 3.7.0 and go straight to the latest version?
You can skip installing a version, but not what changed in it. Expect the move to Add-ons to apply when you jump past 3.7.0, and read the notes for every version since yours.
How can I tell if a BuddyBoss update is a security update?
Open the note for that version, because the main releases page doesn’t label them. Look for words like security issue or permission checks, then ask whether it touches something your site uses.
