Live › vulnerability › CVE-2026-76124
The BuddyBoss App plugin for WordPress accepts uploaded files through its send_feedback function without checking file type or extension, relying only on the client-supplied Content-Type header. An authenticated attacker with subscriber-level access can upload an executable file, which can lead to remote code execution on the WordPress server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 13:20 UTC. All times on this page are UTC.
WordPress sites running the BuddyBoss App plugin (buddyboss-app) 3.2.1 or earlier. Any logged-in user, even a Subscriber, can upload a file through the send_feedback function. Sites that allow open registration are most at risk. Sites without this plugin can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| buddyboss-app | wordpress | <= 3.2.1 | 3.2.2 |
3.2.1 or lower is vulnerableUpdate the BuddyBoss App plugin to or later (per Wordfence).
3.2.2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content inspection or extension validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. While uploaded files are deleted after email transmission, a race condition exists during SMTP execution that allows access to the file, and files persist indefinitely when wp_mail() fails.
This page as .md · .json · in your agent: get_signal("CVE-2026-76124")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.