CVE-2026-107622

    Dashboard / Vulnerabilities / CVE-2026-107622

    CVE-2026-107622

    Published: 6 Nov 2026Last Modified: 8 Nov 2026

    Summary: BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter

    Details: The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the `bf_post_type` parameter. This is due to the public frontend submission handler `buddyforms_form_response_no_ajax()` authorizing logged-out submissions based solely on the target form's `public_submit` flag while independently trusting the attacker-supplied `$_POST['bf_post_type']` to determine the post type of the newly created object — a cross-check introduced in 2.10.2 applies only to existing posts (`post_id != 0`) and is completely bypassed for new-object creation — combined with the `save_post` listener `buddyforms_edit_form_save_meta_box_data()` lacking both a `current_user_can()` capability check and a form-builder nonce, causing it to unconditionally persist attacker-supplied `$_POST['buddyforms_options']` for any newly inserted `buddyforms` CPT post. This makes it possible for unauthenticated attackers to insert a rogue BuddyForms form configuration with an attacker-controlled `new_user_role` value into the live global form registry, then submit a registration through that form to create a new WordPress account with administrator-level privileges and achieve full site takeover. Exploitation requires the WordPress site to have "Anyone can register" enabled and at least one public BuddyForms form attached to a page, both of which are standard BuddyForms deployment configurations.

    References: https://github.com/Themekraft/buddyforms/pull/779/files, https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.10.2/includes/admin/register-post-types.php#L216, https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.10.2/includes/form/form-control.php#L258, https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.10.2/includes/form/form-control.php#L642, https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.10.2/includes/form/form.php#L476, https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.10.2/includes/wp-insert-user.php#L241, https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.10.2/includes/wp-insert-user.php#L702, https://plugins.trac.wordpress.org/changeset/3780268/buddyforms/trunk/includes/admin/register-post-types.php, https://www.wordfence.com/threat-intel/vulnerabilities/id/2e83e654-f8a6-44a6-a687-92606331309e?source=cve, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107622.json, https://nvd.nist.gov/vuln/detail/CVE-2026-107622

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    2.10.5
    2.10.4
    2.10.3
    2.10.2
    2.10.1
    2.10.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-107622 | CVE-DB