{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3abuddyformsbuddyformswordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:buddyforms:buddyforms:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"id":"CVE-2026-107622"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["BuddyForms (\u003c= 2.10.5)"],"_cs_severities":["critical"],"_cs_tags":["wordpress","plugin","vulnerability","privilege-escalation"],"_cs_type":"advisory","_cs_vendors":["BuddyForms"],"content_html":"\u003cp\u003eThe BuddyForms plugin for WordPress (versions 2.10.5 and earlier) contains a critical privilege escalation vulnerability due to improper input validation and missing authorization checks. The plugin's public submission handler, \u003ccode\u003ebuddyforms_form_response_no_ajax()\u003c/code\u003e, improperly trusts the \u003ccode\u003ebf_post_type\u003c/code\u003e parameter when handling new object creation. An unauthenticated attacker can supply a malicious form configuration via the \u003ccode\u003ebuddyforms_options\u003c/code\u003e parameter to override the \u003ccode\u003enew_user_role\u003c/code\u003e setting. This allows an attacker to register a new account on a site where \u0026quot;Anyone can register\u0026quot; is enabled, granting that account administrator-level privileges.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a WordPress site with the BuddyForms plugin and \u0026quot;Anyone can register\u0026quot; enabled.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a POST request to the \u003ccode\u003ebuddyforms_form_response_no_ajax\u003c/code\u003e handler.\u003c/li\u003e\n\u003cli\u003eAttacker specifies a malicious \u003ccode\u003ebf_post_type\u003c/code\u003e and injects an arbitrary form configuration via the \u003ccode\u003ebuddyforms_options\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003eThe plugin fails to validate the request or verify authorization, permitting the creation of a rogue form entry in the global registry.\u003c/li\u003e\n\u003cli\u003eThe rogue form is configured to assign the administrator role to new registrants via the \u003ccode\u003enew_user_role\u003c/code\u003e field.\u003c/li\u003e\n\u003cli\u003eAttacker submits a user registration through the newly created rogue form.\u003c/li\u003e\n\u003cli\u003eWordPress creates the account with administrative privileges, resulting in full site compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to gain full administrative control over the WordPress site.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the BuddyForms plugin to the latest patched version (post-2.10.5).\u003c/li\u003e\n\u003cli\u003eIf an update cannot be applied immediately, disable public registration on the WordPress site.\u003c/li\u003e\n\u003cli\u003eAudit existing BuddyForms forms for unauthorized configuration changes or unexpected \u003ccode\u003enew_user_role\u003c/code\u003e values.\u003c/li\u003e\n\u003cli\u003eAudit the WordPress user database for newly created administrator accounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T13:09:31Z","date_published":"2026-11-06T13:09:31Z","id":"https://feed.craftedsignal.io/briefs/2026-11-buddyforms-privilege-escalation/","summary":"The BuddyForms WordPress plugin is vulnerable to unauthenticated privilege escalation via a form-type confusion flaw that allows attackers to create administrator accounts.","title":"BuddyForms: Privilege escalation via form submission (CVE-2026-107622)","url":"https://feed.craftedsignal.io/briefs/2026-11-buddyforms-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:buddyforms:buddyforms:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}