---
id: "CVE-2026-107622"
page: "https://infrastack.ai/live/CVE-2026-107622"
kind: "vulnerability"
aliases: ["CVE-2026-107622"]
title: "BuddyForms WordPress plugin: unauthenticated admin account creation and site takeover"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["buddyforms", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-public-buddyforms-form", "plugin-not-installed", "registration-closed"]
published_at: "2026-11-06T12:17:16+00:00"
first_seen_at: "2026-11-06T12:41:48+00:00"
updated_at: "2026-11-06T12:42:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107622", "first_seen_at": "2026-11-06T12:41:48+00:00"}]
exploit_sources: []
---

# BuddyForms WordPress plugin: unauthenticated admin account creation and site takeover

Link for people: https://infrastack.ai/live/CVE-2026-107622 (this .md is for agents)

The BuddyForms plugin for WordPress lets logged-out visitors insert a rogue form configuration through a public submission, then register a new account with a chosen role. An attacker who does this gets an administrator account and full control of the WordPress site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the installed BuddyForms plugin version is `2.10.5` or earlier in the WordPress plugins screen or the plugin's main file header
- Check whether 'Anyone can register' is enabled under Settings > General in WordPress
- Check whether any public BuddyForms form is attached to a page

## Fix

- BuddyForms plugin: unknown (the sources state the vulnerable range through `2.10.5` but name no fixed version)

## Timeline

- 2026-11-06T12:41:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107622

## From the sources

The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the `bf_post_type` parameter. This is due to the public frontend submission handler `buddyforms_form_response_no_ajax()` authorizing logged-out submissions based solely on the target form's `public_submit` flag while independently trusting the attacker-supplied `$_POST['bf_post_type']` to determine the post type of the newly created object — a cross-check introduced in 2.10.2 applies only to existing posts (`post_id != 0`) and is completely bypassed for new-object creation — combined with the `save_post` listener `buddyforms_edit_form_save_meta_box_data()` lacking both a `current_user_can()` capability check and a form-builder nonce, causing it to unconditionally persist attacker-supplied `$_POST['buddyforms_options']` for any newly inserted `buddyforms` CPT post. This makes it possible for unauthenticated attackers to insert a rogue BuddyForms form configuration with an attacker-controlled `new_user_role` value into the live global form registry, then submit a registration through that form to create a new WordPress account with administrator-level privileges and achieve full site takeover. Exploitation requires the WordPress site to have "Anyone can register" enabled and at least one public BuddyForms form attached to a page, both of which are standard BuddyForms deployment configurations.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_