Arbitrary File Upload Vulnerability in BuddyBoss App Plugin for WordPress

CVE-2026-76124

What is CVE-2026-76124?

The BuddyBoss App plugin for WordPress contains a critical vulnerability that allows authenticated attackers with subscriber-level access and above to exploit arbitrary file uploads through the send_feedback function. The issue arises from inadequate file type validation, relying only on the client-supplied Content-Type header, without performing necessary server-side content checks. This oversight can enable the upload of potentially executable files, leading to remote code execution risks. Although uploaded files are typically deleted following email transmission, a race condition in the SMTP execution could permit access to these files, which may remain accessible indefinitely if the wp_mail() function encounters a failure.

References