BuddyForms: Privilege escalation via form submission (CVE-2026-107622)

The BuddyForms plugin for WordPress (versions 2.10.5 and earlier) contains a critical privilege escalation vulnerability due to improper input validation and missing authorization checks. The plugin's public submission handler, buddyforms_form_response_no_ajax(), improperly trusts the bf_post_type parameter when handling new object creation. An unauthenticated attacker can supply a malicious form configuration via the buddyforms_options parameter to override the new_user_role setting. This allows an attacker to register a new account on a site where "Anyone can register" is enabled, granting that account administrator-level privileges.

Attack Chain

1. Attacker identifies a WordPress site with the BuddyForms plugin and "Anyone can register" enabled.
2. Attacker crafts a POST request to the buddyforms_form_response_no_ajax handler.
3. Attacker specifies a malicious bf_post_type and injects an arbitrary form configuration via the buddyforms_options parameter.
4. The plugin fails to validate the request or verify authorization, permitting the creation of a rogue form entry in the global registry.
5. The rogue form is configured to assign the administrator role to new registrants via the new_user_role field.
6. Attacker submits a user registration through the newly created rogue form.
7. WordPress creates the account with administrative privileges, resulting in full site compromise.

Impact

Successful exploitation allows an unauthenticated attacker to gain full administrative control over the WordPress site.

Recommendation

• Immediately update the BuddyForms plugin to the latest patched version (post-2.10.5).
• If an update cannot be applied immediately, disable public registration on the WordPress site.
• Audit existing BuddyForms forms for unauthorized configuration changes or unexpected new_user_role values.
• Audit the WordPress user database for newly created administrator accounts.