{"id":"CVE-2026-107622","kind":"vulnerability","aliases":["CVE-2026-107622"],"related":[],"title":"BuddyForms WordPress plugin: unauthenticated admin account creation and site takeover","description":"The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the `bf_post_type` parameter. This is due to the public frontend submission handler `buddyforms_form_response_no_ajax()` authorizing logged-out submissions based solely on the target form's `public_submit` flag while independently trusting the attacker-supplied `$_POST['bf_post_type']` to determine the post type of the newly created object — a cross-check introduced in 2.10.2 applies only to existing posts (`post_id != 0`) and is completely bypassed for new-object creation — combined with the `save_post` listener `buddyforms_edit_form_save_meta_box_data()` lacking both a `current_user_can()` capability check and a form-builder nonce, causing it to unconditionally persist attacker-supplied `$_POST['buddyforms_options']` for any newly inserted `buddyforms` CPT post. This makes it possible for unauthenticated attackers to insert a rogue BuddyForms form configuration with an attacker-controlled `new_user_role` value into the live global form registry, then submit a registration through that form to create a new WordPress account with administrator-level privileges and achieve full site takeover. Exploitation requires the WordPress site to have \"Anyone can register\" enabled and at least one public BuddyForms form attached to a page, both of which are standard BuddyForms deployment configurations.","summary":"The BuddyForms plugin for WordPress lets logged-out visitors insert a rogue form configuration through a public submission, then register a new account with a chosen role. An attacker who does this gets an administrator account and full control of the WordPress site.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["buddyforms","package","self-hosted","wordpress"],"not_affected_if":["no-public-buddyforms-form","plugin-not-installed","registration-closed"],"how_to_check":"- Check whether the installed BuddyForms plugin version is `2.10.5` or earlier in the WordPress plugins screen or the plugin's main file header\n- Check whether 'Anyone can register' is enabled under Settings > General in WordPress\n- Check whether any public BuddyForms form is attached to a page","fix":"- BuddyForms plugin: unknown (the sources state the vulnerable range through `2.10.5` but name no fixed version)","status":"open","published_at":"2026-11-06T12:17:16+00:00","first_seen_at":"2026-11-06T12:41:48+00:00","triaged_at":"2026-11-06T12:42:38+00:00","updated_at":"2026-11-06T12:42:38+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T12:42:38Z","model":"claude-haiku-5-5","output":{"fix":"- BuddyForms plugin: unknown (the sources state the vulnerable range through `2.10.5` but name no fixed version)","reach":"internet","title":"BuddyForms WordPress plugin: unauthenticated admin account creation and site takeover","impact":"high","summary":"The BuddyForms plugin for WordPress lets logged-out visitors insert a rogue form configuration through a public submission, then register a new account with a chosen role. An attacker who does this gets an administrator account and full control of the WordPress site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","buddyforms","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated attacker gains administrator account and full site takeover","analyst_note":"Confirm the fixed BuddyForms version after 2.10.5 from the plugin changelog or the NVD/Wordfence entry, since no source gives one.","how_to_check":"- Check whether the installed BuddyForms plugin version is `2.10.5` or earlier in the WordPress plugins screen or the plugin's main file header\n- Check whether 'Anyone can register' is enabled under Settings > General in WordPress\n- Check whether any public BuddyForms form is attached to a page","plain_action":"","needs_analyst":true,"not_affected_if":["registration-closed","no-public-buddyforms-form","plugin-not-installed"],"who_is_affected":"Sites running BuddyForms `2.10.5` or earlier where 'Anyone can register' is enabled and at least one public BuddyForms form sits on a page. Sites with registration closed, or with no public BuddyForms form, are not exposed through this path. Hosts that run WordPress without this plugin can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000789,"input_tokens":4617,"output_tokens":654,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-107622':13A,16A '-2026':12A,15A '0':162C '2.10.2':154C '2.10.5':84C 'account':6A,46B,59B,258C 'achiev':265C 'admin':5A 'administr':58B,261C 'administrator-level':260C 'ajax':111C 'anyon':276C 'appli':155C 'attach':287C 'attack':52B,91C,132C,205C,223C,234C 'attacker-control':233C 'attacker-suppli':131C,204C 'author':112C 'base':117C 'bf':94C,135C 'box':183C 'buddyform':1A,17B,24B,68C,107C,178C,208C,214C,228C,285C,296C 'builder':197C 'bypass':166C 'capabl':191C 'caus':199C 'check':151C,192C 'chosen':49B 'combin':172C 'complet':165C 'configur':37B,230C,298C 'confus':90C 'control':62B,235C 'cpt':215C 'creat':146C,254C 'creation':7A,171C 'cross':150C 'cross-check':149C 'current':188C 'cve':11A,14A 'data':184C 'deploy':297C 'determin':139C 'due':100C 'edit':179C 'enabl':279C 'escal':76C 'exist':158C 'exploit':269C 'flag':126C 'form':36B,88C,108C,122C,180C,196C,229C,244C,252C,286C 'form-build':195C 'form-typ':87C 'frontend':104C 'full':61B,266C 'get':56B 'global':243C 'handler':106C 'host':21B 'id':161C 'includ':83C 'independ':128C 'insert':33B,213C,225C 'introduc':152C 'lack':185C 'least':282C 'let':28B 'level':262C 'listen':177C 'live':242C 'log':30B,114C 'logged-out':29B,113C 'make':218C 'meta':182C 'new':45B,169C,236C,256C 'new-object':168C 'newli':145C,212C 'nonc':198C 'object':147C,170C 'one':283C 'option':209C 'packag':18B 'page':290C 'paramet':97C 'persist':203C 'plugin':3A,25B,69C 'possibl':220C 'post':95C,134C,136C,141C,159C,160C,176C,207C,216C 'privileg':75C,263C 'public':40B,103C,124C,284C 'regist':43B,278C 'registr':249C 'registri':245C 'requir':270C 'respons':109C 'rogu':35B,227C 'role':50B,238C 'save':175C,181C 'self':20B 'self-host':19B 'site':9A,66B,267C,273C 'sole':118C 'standard':295C 'submiss':41B,105C,116C 'submit':125C,247C 'suppli':133C,206C 'takeov':10A,268C 'target':121C 'trust':129C 'type':89C,96C,137C,142C 'unauthent':4A,222C 'uncondit':202C 'user':189C,237C 'valu':239C 'version':79C 'via':85C 'visitor':32B 'vulner':73C 'wordpress':2A,22B,27B,65B,71C,257C,272C","nicknames":[],"mitigations":[],"who_affected":"Sites running BuddyForms `2.10.5` or earlier where 'Anyone can register' is enabled and at least one public BuddyForms form sits on a page. Sites with registration closed, or with no public BuddyForms form, are not exposed through this path. Hosts that run WordPress without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["buddyforms","critical","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-107622':13A,16A '-2026':12A,15A 'account':6A 'admin':5A 'buddyform':1A 'creation':7A 'cve':11A,14A 'plugin':3A 'site':9A 'takeov':10A 'unauthent':4A 'wordpress':2A","search_b":"'account':46B,59B 'administr':58B 'attack':52B 'buddyform':17B,24B 'chosen':49B 'configur':37B 'control':62B 'form':36B 'full':61B 'get':56B 'host':21B 'insert':33B 'let':28B 'log':30B 'logged-out':29B 'new':45B 'packag':18B 'plugin':25B 'public':40B 'regist':43B 'rogu':35B 'role':50B 'self':20B 'self-host':19B 'site':66B 'submiss':41B 'visitor':32B 'wordpress':22B,27B,65B","search_c":"'0':162C '2.10.2':154C '2.10.5':84C 'account':258C 'achiev':265C 'administr':261C 'administrator-level':260C 'ajax':111C 'anyon':276C 'appli':155C 'attach':287C 'attack':91C,132C,205C,223C,234C 'attacker-control':233C 'attacker-suppli':131C,204C 'author':112C 'base':117C 'bf':94C,135C 'box':183C 'buddyform':68C,107C,178C,208C,214C,228C,285C,296C 'builder':197C 'bypass':166C 'capabl':191C 'caus':199C 'check':151C,192C 'combin':172C 'complet':165C 'configur':230C,298C 'confus':90C 'control':235C 'cpt':215C 'creat':146C,254C 'creation':171C 'cross':150C 'cross-check':149C 'current':188C 'data':184C 'deploy':297C 'determin':139C 'due':100C 'edit':179C 'enabl':279C 'escal':76C 'exist':158C 'exploit':269C 'flag':126C 'form':88C,108C,122C,180C,196C,229C,244C,252C,286C 'form-build':195C 'form-typ':87C 'frontend':104C 'full':266C 'global':243C 'handler':106C 'id':161C 'includ':83C 'independ':128C 'insert':213C,225C 'introduc':152C 'lack':185C 'least':282C 'level':262C 'listen':177C 'live':242C 'log':114C 'logged-out':113C 'make':218C 'meta':182C 'new':169C,236C,256C 'new-object':168C 'newli':145C,212C 'nonc':198C 'object':147C,170C 'one':283C 'option':209C 'page':290C 'paramet':97C 'persist':203C 'plugin':69C 'possibl':220C 'post':95C,134C,136C,141C,159C,160C,176C,207C,216C 'privileg':75C,263C 'public':103C,124C,284C 'regist':278C 'registr':249C 'registri':245C 'requir':270C 'respons':109C 'rogu':227C 'role':238C 'save':175C,181C 'site':267C,273C 'sole':118C 'standard':295C 'submiss':105C,116C 'submit':125C,247C 'suppli':133C,206C 'takeov':268C 'target':121C 'trust':129C 'type':89C,96C,137C,142C 'unauthent':222C 'uncondit':202C 'user':189C,237C 'valu':239C 'version':79C 'via':85C 'vulner':73C 'wordpress':71C,257C,272C","first_public_at":"2026-11-06T12:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107622","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107622","severity":null,"published_at":"2026-11-06T12:17:16+00:00","modified_at":"2026-11-06T12:17:16+00:00","first_seen_at":"2026-11-06T12:41:48+00:00","fetched_at":"2026-11-06T12:41:48+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}