---
id: "CVE-2026-76124"
kind: "vulnerability"
aliases: ["CVE-2026-76124"]
title: "BuddyBoss App WordPress plugin: arbitrary file upload enables remote code execution"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "buddyboss-app", "fixed": ["3.2.2"], "affected": "<= 3.2.1", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["auth-required", "buddyboss-app", "package", "self-hosted", "wordpress"]
not_affected_if: ["auth-required", "newer-version", "plugin-not-installed"]
published_at: "2026-11-03T13:17:23+00:00"
first_seen_at: "2026-11-03T13:20:53+00:00"
updated_at: "2026-11-03T13:21:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76124", "first_seen_at": "2026-11-03T13:20:53+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T13:21:58+00:00"}]
---

# BuddyBoss App WordPress plugin: arbitrary file upload enables remote code execution

The BuddyBoss App plugin for WordPress accepts uploaded files through its send_feedback function without checking file type or extension, relying only on the client-supplied Content-Type header. An authenticated attacker with subscriber-level access can upload an executable file, which can lead to remote code execution on the WordPress server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:buddyboss-app affected <= 3.2.1 fixed 3.2.2

## How to check

In WordPress admin > Plugins, check the BuddyBoss App (slug buddyboss-app) version; 3.2.1 or lower is vulnerable. Also look in wp-content/uploads for unexpected .php or other executable files, especially if outgoing mail (wp_mail) fails on the site.

## Fix

Update the BuddyBoss App plugin to 3.2.2 or later (per Wordfence).

## Timeline

- 2026-11-03T13:20:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76124
- 2026-11-03T13:21:58+00:00 analyst — Wordfence (CNA) advisory: affects <=3.2.1, patched 3.2.2. Vendor changelog not read, so nothing marked verified. No exploitation or PoC reported.

## Documents

- [advisory] Wordfence: BuddyBoss App <= 3.2.1 Subscriber+ Arbitrary File Upload https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/buddyboss-app/buddyboss-app-321-authenticated-subscriber-arbitrary-file-upload-via-feedback-endpoint

## From the sources

The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content inspection or extension validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. While uploaded files are deleted after email transmission, a race condition exists during SMTP execution that allows access to the file, and files persist indefinitely when wp_mail() fails.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_