{"id":"CVE-2026-76124","kind":"vulnerability","aliases":["CVE-2026-76124"],"related":[],"title":"BuddyBoss App WordPress plugin: arbitrary file upload enables remote code execution","description":"The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content inspection or extension validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. While uploaded files are deleted after email transmission, a race condition exists during SMTP execution that allows access to the file, and files persist indefinitely when wp_mail() fails.","summary":"The BuddyBoss App plugin for WordPress accepts uploaded files through its send_feedback function without checking file type or extension, relying only on the client-supplied Content-Type header. An authenticated attacker with subscriber-level access can upload an executable file, which can lead to remote code execution on the WordPress server.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"buddyboss-app","fixed":["3.2.2"],"affected":"<= 3.2.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["auth-required","buddyboss-app","package","self-hosted","wordpress"],"not_affected_if":["auth-required","newer-version","plugin-not-installed"],"how_to_check":"In WordPress admin > Plugins, check the BuddyBoss App (slug buddyboss-app) version; 3.2.1 or lower is vulnerable. Also look in wp-content/uploads for unexpected .php or other executable files, especially if outgoing mail (wp_mail) fails on the site.","fix":"Update the BuddyBoss App plugin to 3.2.2 or later (per Wordfence).","status":"open","published_at":"2026-11-03T13:17:23+00:00","first_seen_at":"2026-11-03T13:20:53+00:00","triaged_at":"2026-11-03T13:21:31+00:00","updated_at":"2026-11-03T13:21:58+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T13:21:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"BuddyBoss App WordPress plugin: arbitrary file upload enables remote code execution","impact":"high","summary":"The BuddyBoss App plugin for WordPress accepts uploaded files through its send_feedback function without checking file type or extension, relying only on the client-supplied Content-Type header. An authenticated attacker with subscriber-level access can upload an executable file, which can lead to remote code execution on the WordPress server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","buddyboss-app","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker uploads an executable file and runs code on the server.","analyst_note":"Confirm the fixed plugin version and whether a patch exists; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-76124 and the plugin's changelog.","how_to_check":"- Check whether the BuddyBoss App plugin is installed and its version in the WordPress admin under Plugins.\n- Look for the plugin's version `3.2.1` or lower in the plugin header.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-version"],"who_is_affected":"Sites running the BuddyBoss App plugin for WordPress at version `3.2.1` or earlier, where subscriber-level or higher accounts can reach the send_feedback function. Sites without this plugin, or with it at a fixed version, are not affected. The sources do not state which version fixes it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000732,"input_tokens":4239,"output_tokens":617,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed plugin version and whether a patch exists; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-76124 and the plugin's changelog.","search":"'-2026':13A,16A '-76124':14A,17A '3.2.1':106C 'accept':38B 'access':70B,152C,185C 'allow':184C 'app':2A,20A,26B,34B,89C 'arbitrari':5A,96C 'attack':65B,147C 'auth':22B 'auth-requir':21B 'authent':64B,146C 'buddyboss':1A,19A,25B,33B,88C 'buddyboss-app':18A,24B 'check':47B 'client':57B,126C 'client-suppli':56B,125C 'code':10A,81B,165C 'condit':178C 'content':60B,129C,136C 'content-typ':59B,128C 'cve':12A,15A 'delet':172C 'due':114C 'email':174C 'enabl':8A 'execut':11A,74B,82B,161C,166C,182C 'exist':179C 'extens':51B,139C 'fail':196C 'feedback':44B,110C 'file':6A,40B,48B,75B,97C,117C,157C,170C,188C,190C 'function':45B,111C 'header':62B,131C 'host':30B 'includ':105C 'indefinit':192C 'inspect':137C 'insuffici':116C 'lead':78B 'level':69B,151C 'mail':195C 'make':142C,163C 'may':159C 'packag':27B 'persist':191C 'plugin':4A,35B,90C 'possibl':144C,167C 'race':177C 'reli':52B,121C 'remot':9A,80B,164C 'requir':23B 'self':29B 'self-host':28B 'send':43B,109C 'server':86B,134C 'server-sid':133C 'side':135C 'smtp':181C 'sole':122C 'subscrib':68B,150C 'subscriber-level':67B,149C 'suppli':58B,127C 'transmiss':175C 'type':49B,61B,118C,130C 'upload':7A,39B,72B,98C,156C,169C 'valid':119C,140C 'version':101C 'via':107C 'vulner':94C 'without':46B,132C 'wordpress':3A,31B,37B,85B,92C 'wp':194C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the BuddyBoss App plugin (buddyboss-app) 3.2.1 or earlier. Any logged-in user, even a Subscriber, can upload a file through the send_feedback function. Sites that allow open registration are most at risk. Sites without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["buddybossapp"],"ptokens":["app","buddyboss"],"labels":["authrequired","buddybossapp","high","package","selfhosted","wordpress"],"first_public_at":"2026-11-03T13:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76124","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76124","severity":null,"published_at":"2026-11-03T13:17:23+00:00","modified_at":"2026-11-03T13:17:23+00:00","first_seen_at":"2026-11-03T13:20:53+00:00","fetched_at":"2026-11-03T13:20:53+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-76124:1486","url":null,"severity":null,"published_at":"2026-11-03T13:21:58+00:00","modified_at":"2026-11-03T13:21:58+00:00","first_seen_at":"2026-11-03T13:21:58+00:00","fetched_at":"2026-11-03T13:21:58+00:00","note":"Wordfence (CNA) advisory: affects <=3.2.1, patched 3.2.2. Vendor changelog not read, so nothing marked verified. No exploitation or PoC reported."}],"documents":[{"id":57752,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/buddyboss-app/buddyboss-app-321-authenticated-subscriber-arbitrary-file-upload-via-feedback-endpoint","title":"Wordfence: BuddyBoss App <= 3.2.1 Subscriber+ Arbitrary File Upload","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}