{"id":"CVE-2026-107622","published":"2026-11-06T12:17:16.020","lastModified":"2026-11-06T16:17:36.057","description":"The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the `bf_post_type` parameter. This is due to the public frontend submission handler `buddyforms_form_response_no_ajax()` authorizing logged-out submissions based solely on the target form's `public_submit` flag while independently trusting the attacker-supplied `$_POST['bf_post_type']` to determine the post type of the newly created object — a cross-check introduced in 2.10.2 applies only to existing posts (`post_id != 0`) and is completely bypassed for new-object creation — combined with the `save_post` listener `buddyforms_edit_form_save_meta_box_data()` lacking both a `current_user_can()` capability check and a form-builder nonce, causing it to unconditionally persist attacker-supplied `$_POST['buddyforms_options']` for any newly inserted `buddyforms` CPT post. This makes it possible for unauthenticated attackers to insert a rogue BuddyForms form configuration with an attacker-controlled `new_user_role` value into the live global form registry, then submit a registration through that form to create a new WordPress account with administrator-level privileges and achieve full site takeover. Exploitation requires the WordPress site to have \"Anyone can register\" enabled and at least one public BuddyForms form attached to a page, both of which are standard BuddyForms deployment configurations.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Themekraft/buddyforms/pull/779/files","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.10.2/includes/admin/register-post-types.php#L216","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.10.2/includes/form/form-control.php#L258","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.10.2/includes/form/form-control.php#L642","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.10.2/includes/form/form.php#L476","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.10.2/includes/wp-insert-user.php#L241","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.10.2/includes/wp-insert-user.php#L702","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3780268/buddyforms/trunk/includes/admin/register-post-types.php","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e83e654-f8a6-44a6-a687-92606331309e?source=cve","tags":[]}],"exploitRefs":[{"url":"https://github.com/Themekraft/buddyforms/pull/779/files","tags":[]}],"hasPoc":true,"ai":{"summary":"The BuddyForms WordPress plugin allows unauthenticated attackers to escalate privileges to administrator by exploiting a form-type confusion vulnerability: the public submission handler trusts attacker-controlled input to set the post type of a new form object, and the associated save function lacks proper capability checks and nonces, enabling an attacker to inject a rogue form configuration with a custom user role and register as admin.","exploitability":"Exploitation is straightforward for unauthenticated attackers on sites where 'Anyone can register' is enabled and at least one public BuddyForms form exists; no authentication or special privileges are required.","blast_radius":"Successful exploitation grants full site takeover, including data exfiltration, defacement, malware deployment, and lateral movement via compromised admin accounts.","remediation":"Upgrade to BuddyForms version 2.10.6 or later, which addresses the form-type confusion and adds proper capability checks and nonces in the affected handlers.","detection":"Look for POST requests to the BuddyForms frontend submission endpoint (e.g., /wp-admin/admin-ajax.php?action=buddyforms_form_response_no_ajax) containing a `bf_post_type` parameter set to `buddyforms`, especially when combined with `buddyforms_options[new_user_role]=administrator` and a subsequent user registration event for an unauthenticated IP address.","tags":["privilege-escalation","wordpress","plugin-vulnerability","form-confusion","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-11-07T09:52:45.589Z"}}