CVE-2026-107622 is a critical (CVSS 9.8) privilege escalation flaw in the BuddyForms WordPress plugin, up to and including version 2.10.5. On sites that meet certain configuration conditions, it could let an unauthenticated attacker create an administrator account, which could lead to site takeover.
What Is It
The flaw is a form-type confusion attack through the bf_post_type parameter (CWE-269, Improper Privilege Management). Two weaknesses combine to cause it:
- The public frontend submission handler
buddyforms_form_response_no_ajax()allows logged-out submissions based only on the target form'spublic_submitflag. It also trusts the attacker-supplied$_POST['bf_post_type']to decide what type of post to create. A cross-check added in 2.10.2 covers only existing posts (post_id != 0), so creating a new object skips it completely. - The
save_postlistenerbuddyforms_edit_form_save_meta_box_data()has nocurrent_user_can()capability check and no form-builder nonce. It saves attacker-supplied$_POST['buddyforms_options']for any newly insertedbuddyformscustom post type post, without conditions.
According to the advisory, an attacker can add a rogue form configuration with a chosen new_user_role value to the live global form registry. They could then register through that form and get a new WordPress account with administrator privileges.
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N: the attack works over the network, has low complexity, and needs no privileges or user interaction. Confidentiality, integrity and availability impacts are all rated High. A successful attack could give the attacker full control of the affected site.
Two conditions must be met: "Anyone can register" must be enabled, and at least one public BuddyForms form must be attached to a page. The NVD description notes that both are standard BuddyForms setups, so many installs may meet them.
None of the sources listed below report active exploitation of this flaw.
What's Vulnerable
- Vendor: themekraft
- Product: BuddyForms (WordPress plugin)
- Affected versions: all versions up to and including 2.10.5
Patch Status
The NVD record lists a fix pull request in the Themekraft BuddyForms GitHub repository and a WordPress plugin trac changeset to register-post-types.php. It does not name a fixed release version. NVD status is "Deferred."
What to do:
- Update BuddyForms to a version newer than 2.10.5 once the vendor confirms it includes the fix.
- Until you can update, consider turning off "Anyone can register" or removing public BuddyForms forms.
- Check for user accounts with unexpected administrator roles, and for unfamiliar buddyforms form entries.