https://feed.craftedsignal.io/cpes/cpe2.3abuddybossapp/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 13:57:14 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-buddyboss-upload/Tue, 03 Nov 2026 13:57:14 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-buddyboss-upload/The BuddyBoss App WordPress plugin (all versions up to and including 3.2.1) is vulnerable to Arbitrary File Upload via the send_feedback function, which may lead to remote code execution.<p>The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to and including 3.2.1 via the send_feedback function. The vulnerability arises from insufficient file type validation that relies on the client-supplied Content-Type header. Authenticated users with subscriber-level access and above can upload executable files. While files are intended to be deleted after transmission, a race condition during SMTP execution or a failure of the wp_mail() function can allow files to persist on the server.</p> highadvisory