CVE-2026-107622
Full vulnerability record from the local CVENow database.
Description
The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the `bf_post_type` parameter. This is due to the public frontend submission handler `buddyforms_form_response_no_ajax()` authorizing logged-out submissions based solely on the target form's `public_submit` flag while independently trusting the attacker-supplied `$_POST['bf_post_type']` to determine the post type of the newly created object — a cross-check introduced in 2.10.2 applies only to existing posts (`post_id != 0`) and is completely bypassed for new-object creation — combined with the `save_post` listener `buddyforms_edit_form_save_meta_box_data()` lacking both a `current_user_can()` capability check and a form-builder nonce, causing it to unconditionally persist attacker-supplied `$_POST['buddyforms_options']` for any newly inserted `buddyforms` CPT post. This makes it possible for unauthenticated attackers to insert a rogue BuddyForms form configuration with an attacker-controlled `new_user_role` value into the live global form registry, then submit a registration through that form to create a new WordPress account with administrator-level privileges and achieve full site takeover. Exploitation requires the WordPress site to have "Anyone can register" enabled and at least one public BuddyForms form attached to a page, both of which are standard BuddyForms deployment configurations.
View original CVE JSON
{
"id": "CVE-2026-107622",
"sourceIdentifier": "[email protected]",
"published": "2026-11-06T12:17:16.020",
"lastModified": "2026-11-06T16:17:36.057",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the `bf_post_type` parameter. This is due to the public frontend submission handler `buddyforms_form_response_no_ajax()` authorizing logged-out submissions based solely on the target form's `public_submit` flag while independently trusting the attacker-supplied `$_POST['bf_post_type']` to determine the post type of the newly created object — a cross-check introduced in 2.10.2 applies only to existing posts (`post_id != 0`) and is completely bypassed for new-object creation — combined with the `save_post` listener `buddyforms_edit_form_save_meta_box_data()` lacking both a `current_user_can()` capability check and a form-builder nonce, causing it to unconditionally persist attacker-supplied `$_POST['buddyforms_options']` for any newly inserted `buddyforms` CPT post. This makes it possible for unauthenticated attackers to insert a rogue BuddyForms form configuration with an attacker-controlled `new_user_role` value into the live global form registry, then submit a registration through that form to create a new WordPress account with administrator-level privileges and achieve full site takeover. Exploitation requires the WordPress site to have \"Anyone can register\" enabled and at least one public BuddyForms form attached to a page, both of which are standard BuddyForms deployment configurations."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "themekraft",
"product": "BuddyForms",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "2.10.5",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-11-06T15:11:19.906236Z",
"id": "CVE-2026-107622",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-269"
}
]
}
],
"references": [
{
"url": "https://github.com/Themekraft/buddyforms/pull/779/files",
"source": "[email protected]"
},
{
"url": "https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.10.2/includes/admin/register-post-types.php#L216",
"source": "[email protected]"
},
{
"url": "https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.10.2/includes/form/form-control.php#L258",
"source": "[email protected]"
},
{
"url": "https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.10.2/includes/form/form-control.php#L642",
"source": "[email protected]"
},
{
"url": "https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.10.2/includes/form/form.php#L476",
"source": "[email protected]"
},
{
"url": "https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.10.2/includes/wp-insert-user.php#L241",
"source": "[email protected]"
},
{
"url": "https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.10.2/includes/wp-insert-user.php#L702",
"source": "[email protected]"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3780268/buddyforms/trunk/includes/admin/register-post-types.php",
"source": "[email protected]"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2e83e654-f8a6-44a6-a687-92606331309e?source=cve",
"source": "[email protected]"
}
]
}