{"id":"CVE-2026-76124","published":"2026-11-03T13:17:23.413","lastModified":"2026-11-03T13:17:23.547","description":"The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content inspection or extension validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. While uploaded files are deleted after email transmission, a race condition exists during SMTP execution that allows access to the file, and files persist indefinitely when wp_mail() fails.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://buddyboss.com/resources/buddyboss-app-plugin-releases/3-2-2/","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56a1219c-1163-4867-b426-7ffe9ca5dcb5?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The BuddyBoss App WordPress plugin (≤3.2.1) allows authenticated attackers to upload arbitrary files via the send_feedback function due to insufficient server-side validation of file types—only checking the untrusted client-supplied Content-Type header without inspecting content or enforcing extension rules. Although uploaded files are intended to be deleted after email transmission, a race condition during SMTP execution and persistence on wp_mail() failure enables potential remote code execution.","exploitability":"Exploitation requires low skill and only authenticated access at subscriber level or higher, with no user interaction needed.","blast_radius":"Successful exploitation could lead to full system compromise (confidentiality, integrity, availability) via remote code execution on the WordPress server.","remediation":"Upgrade to BuddyBoss App version 3.2.2 or later, which addresses the insufficient file type validation in send_feedback.","detection":"Monitor for unexpected file creation in temporary or upload directories (e.g., wp-content/uploads) with non-image extensions (e.g., .php, .phtml) shortly after a user submits feedback, especially if followed by HTTP requests to those files; also watch for SMTP-related errors in wp_mail logs coinciding with such uploads.","tags":["arbitrary-file-upload","race-condition","rce","wordpress","auth-bypass"],"model":"garnet-coder","analyzedAt":"2026-11-04T09:56:51.024Z"}}