CVE-2026-76124

Name of the Vulnerable Software and Affected Versions BuddyBoss App plugin for WordPress versions prior to 3.2.2

Description An arbitrary file upload issue exists in the send feedback() function. The flaw stems from insufficient file type validation, as the system relies exclusively on the client-supplied Content-Type header without performing server-side content inspection or extension validation. Authenticated attackers with subscriber-level access or higher can upload executable files, potentially leading to remote code execution. Although files are typically deleted after email transmission, a race condition during SMTP execution can allow access to the file, and files remain on the server indefinitely if the wp mail() function fails.

Recommendations Update the BuddyBoss App plugin for WordPress to version 3.2.2 or later. As a temporary mitigation, restrict access to the send feedback() function for users with subscriber-level permissions.