Privilege Escalation in BuddyForms Plugin for WordPress

CVE-2026-107622

What is CVE-2026-107622?

The BuddyForms plugin for WordPress is susceptible to a privilege escalation flaw due to improper handling of form submissions. This vulnerability enables unauthenticated attackers to exploit the bf_post_type parameter through a form-type confusion attack. By exploiting the public submission handler, attackers can bypass security checks designed for existing posts, resulting in the unauthorized insertion of malicious form configurations. This flaw allows attackers to manipulate user roles, potentially granting themselves administrative privileges and leading to complete site takeover, provided the site allows user registrations and has at least one public BuddyForms form active.

References