CVE-2026-107622

9.8 CRITICALpublic exploit available

Published 2026-11-06 · Updated 2026-11-06

AI risk analysis

Summary: The BuddyForms WordPress plugin allows unauthenticated attackers to escalate privileges to administrator by exploiting a form-type confusion vulnerability: the public submission handler trusts attacker-controlled input to set the post type of a new form object, and the associated save function lacks proper capability checks and nonces, enabling an attacker to inject a rogue form configuration with a custom user role and register as admin.
Exploitability: Exploitation is straightforward for unauthenticated attackers on sites where 'Anyone can register' is enabled and at least one public BuddyForms form exists; no authentication or special privileges are required.
Blast radius: Successful exploitation grants full site takeover, including data exfiltration, defacement, malware deployment, and lateral movement via compromised admin accounts.
Detection: Look for POST requests to the BuddyForms frontend submission endpoint (e.g., /wp-admin/admin-ajax.php?action=buddyforms_form_response_no_ajax) containing a `bf_post_type` parameter set to `buddyforms`, especially when combined with `buddyforms_options[new_user_role]=administrator` and a subsequent user registration event for an unauthenticated IP address.
Prioritized remediation: Upgrade to BuddyForms version 2.10.6 or later, which addresses the form-type confusion and adds proper capability checks and nonces in the affected handlers.

privilege-escalationwordpressplugin-vulnerabilityform-confusionunauthenticated

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the `bf_post_type` parameter. This is due to the public frontend submission handler `buddyforms_form_response_no_ajax()` authorizing logged-out submissions based solely on the target form's `public_submit` flag while independently trusting the attacker-supplied `$_POST['bf_post_type']` to determine the post type of the newly created object — a cross-check introduced in 2.10.2 applies only to existing posts (`post_id != 0`) and is completely bypassed for new-object creation — combined with the `save_post` listener `buddyforms_edit_form_save_meta_box_data()` lacking both a `current_user_can()` capability check and a form-builder nonce, causing it to unconditionally persist attacker-supplied `$_POST['buddyforms_options']` for any newly inserted `buddyforms` CPT post. This makes it possible for unauthenticated attackers to insert a rogue BuddyForms form configuration with an attacker-controlled `new_user_role` value into the live global form registry, then submit a registration through that form to create a new WordPress account with administrator-level privileges and achieve full site takeover. Exploitation requires the WordPress site to have "Anyone can register" enabled and at least one public BuddyForms form attached to a page, both of which are standard BuddyForms deployment configurations.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-269

Public exploit & PoC references

https://github.com/Themekraft/buddyforms/pull/779/files

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.