The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type…

The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the bfposttype parameter. This is due to the public frontend submission handler buddyformsformresponsenoajax() authorizing logged-out submissions based solely on the target form's publicsubmit flag while independently trusting the attacker-supplied $POST['bfposttype'] to determine the post type of the newly created object — a cross-check introduced in 2.10.2 applies only to existing posts (postid != 0) and is completely bypassed for new-object creation — combined with the savepost listener buddyformseditformsavemetaboxdata() lacking both a currentusercan() capability check and a form-builder nonce, causing it to unconditionally persist attacker-supplied $POST['buddyformsoptions'] for any newly inserted buddyforms CPT post. This makes it possible for unauthenticated attackers to insert a rogue BuddyForms form configuration with an attacker-controlled newuserrole value into the live global form registry, then submit a registration through that form to create a new WordPress account with administrator-level privileges and…

curl https://cve.zerocrew.in/api/cve/CVE-2026-107622