CVE-2026-107622: BuddyForms Privilege Escalation to Full Site Takeover

CVE-2026-107622 affects the BuddyForms plugin for WordPress. An unauthenticated attacker can exploit a form-type confusion in the bf_post_type parameter to inject a malicious form configuration into the global form registry. This flaw enables the creation of a WordPress account with administrator privileges without authentication, leading to complete site control.

The severity is critical (CVSS 9.8). Exploitation is possible because the form submission handler authorizes submissions from unregistered users based solely on the public_submit flag, while the post type is determined by the attacker-supplied bf_post_type value. Exploitation requires the WordPress site to have Anyone can register enabled and at least one public BuddyForms form on a page, both standard configurations. The vulnerability was published on 2026-11-06 and signals on X confirm it is already publicly known.

As defense: 1) Immediately update BuddyForms to a version after 2.10.5 as soon as available. 2) If an update is not yet available, temporarily disable public registration via BuddyForms forms or restrict unauthenticated access. 3) Review access logs to detect exploitation attempts and suspicious form submissions. 4) Monitor newly created user accounts to identify unauthorized administrator accounts.