BuddyBoss App: Arbitrary File Upload in send_feedback function (CVE-2026-76124)
The BuddyBoss App WordPress plugin (all versions up to and including 3.2.1) is vulnerable to Arbitrary File Upload via the send_feedback function, which may lead to remote code execution.
CVE search metadata
CVE search record: CVE-2026-76124. Severity: high. CVSS: 8.8. KEV: no. Product: BuddyBoss App (<= 3.2.1). Brief: BuddyBoss App: Arbitrary File Upload in send_feedback function (CVE-2026-76124). Brief link: https://feed.craftedsignal.io/briefs/2026-11-buddyboss-upload/
Triage facts
Revision 2- Applicability
- BuddyBoss App (<= 3.2.1)
- Evidence
- Unknown
- Severity
- High
- Sources
- 3 public sources
- Freshness
- Revision 2Nov 3, 16:15 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: claim_state, has_poc, lastmod, poc_references, references, updates
Sources: 1
The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to and including 3.2.1 via the send_feedback function. The vulnerability arises from insufficient file type validation that relies on the client-supplied Content-Type header. Authenticated users with subscriber-level access and above can upload executable files. While files are intended to be deleted after transmission, a race condition during SMTP execution or a failure of the wp_mail() function can allow files to persist on the server.