Skip to content
Sign in Sign up
JA EN FR
SecPulse
A detailed explainer is available in Japanese. Read the Japanese explainer
Critical 9.8

BuddyFormsに認証不要で管理者を作られる脆弱性、修正版は未確認

CVE-2026-107622 First seen on SecPulse

Summary

WordPressのプラグインBuddyForms 2.10.5以下に、ログインなしで管理者アカウントを作られる脆弱性が公表されました。会員登録を開いているサイトは版を確認し、修正版がなければ登録機能を止めてください。

AI summary

Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.

WordPressのプラグインBuddyForms 2.10.5以下に、ログインなしで管理者アカウントを作られる脆弱性が公表されました。会員登録を開いているサイトは版を確認し、修正版がなければ登録機能を止めてください。

Affected packages

PackageAffected → Fixed
themekraftBuddyForms
≤ 2.10.5→ Not listed

This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.

Original description The description as published by the source.

The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the bf_post_type parameter. This is due to the public frontend submission handler buddyforms_form_response_no_ajax() authorizing logged-out submissions based solely on the target form's public_submit flag while independently trusting the attacker-supplied $_POST['bf_post_type'] to determine the post type of the newly created object — a cross-check introduced in 2.10.2 applies only to existing posts (post_id != 0) and is completely bypassed for new-object creation — combined with the save_post listener buddyforms_edit_form_save_meta_box_data() lacking both a current_user_can() capability check and a form-builder nonce, causing it to unconditionally persist attacker-supplied $_POST['buddyforms_options'] for any newly inserted buddyforms CPT post. This makes it possible for unauthenticated attackers to insert a rogue BuddyForms form configuration with an attacker-controlled new_user_role value into the live global form registry, then submit a registration through that form to create a new WordPress account with administrator-level privileges and achieve full site takeover. Exploitation requires the WordPress site to have "Anyone can register" enabled and at least one public BuddyForms form attached to a page, both of which are standard BuddyForms deployment configurations.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details