CVE-2026-107622

Name of the Vulnerable Software and Affected Versions BuddyForms versions prior to 2.10.6

Description An issue exists where unauthenticated attackers can achieve privilege escalation and full site takeover. This occurs via a form-type confusion attack using the bf post type parameter. The public frontend submission handler buddyforms form response no ajax() authorizes submissions based on the public submit flag but trusts the attacker-supplied bf post type to determine the post type for new objects. Additionally, the save post listener buddyforms edit form save meta box data() lacks a current user can() capability check and a form-builder nonce, allowing the unconditional persistence of attacker-supplied buddyforms options for new buddyforms Custom Post Type (CPT) posts. An attacker can insert a rogue form configuration with a controlled new user role value into the global form registry and then submit a registration through that form to create an administrator account. This requires the WordPress setting Anyone can register to be enabled and at least one public BuddyForms form to be attached to a page.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.