CVE-2026-76124

Summary

The BuddyBoss App WordPress plugin (≤3.2.1) allows authenticated attackers to upload arbitrary files via the send_feedback function due to insufficient server-side validation of file types—only checking the untrusted client-supplied Content-Type header without inspecting content or enforcing extension rules. Although uploaded files are intended to be deleted after email transmission, a race condition during SMTP execution and persistence on wp_mail() failure enables potential remote code execution.

Exploitability

Exploitation requires low skill and only authenticated access at subscriber level or higher, with no user interaction needed.

Blast radius

Successful exploitation could lead to full system compromise (confidentiality, integrity, availability) via remote code execution on the WordPress server.

Detection

Monitor for unexpected file creation in temporary or upload directories (e.g., wp-content/uploads) with non-image extensions (e.g., .php, .phtml) shortly after a user submits feedback, especially if followed by HTTP requests to those files; also watch for SMTP-related errors in wp_mail logs coinciding with such uploads.

Prioritized remediation

Upgrade to BuddyBoss App version 3.2.2 or later, which addresses the insufficient file type validation in send_feedback.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.