BuddyBoss App through 3.2.1 - Subscriber+ Arbitrary File Upload to RCE (CVE-2026-76124)

BuddyBoss App 3.2.1 and earlier allow Subscriber-level attackers to upload potentially executable files through the feedback endpoint. Update to 3.2.2 or later.

BuddyBoss App versions through 3.2.1 contain a high-severity authenticated arbitrary file upload vulnerability in the feedback feature. A Subscriber-level user can upload a file that may be executable, creating a path to remote code execution under vulnerable server configurations. Update to BuddyBoss App 3.2.2 or later immediately.

Table of Contents

Vulnerability summary

Product: BuddyBoss App WordPress plugin
Affected versions: 3.2.1 and earlier
Fixed version: 3.2.2; use the newest supported release available from BuddyBoss
CVE: CVE-2026-76124
Severity: High, CVSS 8.8
Required privilege: Authenticated Subscriber or higher
Attack class: Arbitrary file upload with possible remote code execution
Affected function: send_feedback
Public disclosure: November 2-3, 2026

Wordfence attributes the issue to insufficient file validation in the feedback upload path. The vulnerable implementation relied on the client-supplied Content-Type header without adequately validating the file extension or inspecting the file content on the server.

Exploit path and prerequisites

An attacker needs a valid WordPress account with Subscriber-level access or higher. The attacker can submit a crafted attachment through the BuddyBoss App feedback function. If the web server treats the uploaded file as executable, the result can be arbitrary PHP execution and full site compromise.

The plugin attempts to remove uploaded feedback files after sending email, but that does not eliminate the risk. Wordfence reports a race window while SMTP processing is in progress. If wp_mail() fails, the uploaded file may remain on disk indefinitely, making the exposure easier to exploit.

No authoritative source reviewed for this advisory reported active exploitation, and CVE-2026-76124 was not listed in CISA’s Known Exploited Vulnerabilities catalog at publication time. The low privilege requirement and possible code-execution impact still make prompt patching important.

Required remediation

Update BuddyBoss App to version 3.2.2 or later. BuddyBoss has subsequently published newer 3.2.x releases, so install the newest version supported by your subscription and application build.
Disable the feedback feature or restrict it to trusted users until the update is complete.
Review failed mail events and the filesystem for feedback attachments that were not deleted.
Investigate unexpected Subscriber accounts, recently created users and suspicious uploads before treating the site as clean.
If executable files or other compromise indicators are found, isolate the site, preserve logs, restore from a known-clean backup and rotate WordPress, hosting, database, SFTP/SSH and API credentials.

The official BuddyBoss 3.2.2 release notes say file upload handling was hardened with stricter content and extension validation, safer file names and secure storage locations. Because this is a premium plugin, the update may need to be downloaded through the BuddyBoss account if the normal WordPress updater does not offer it.

Version and update checks

# Read the installed plugin version and update state
wp plugin get buddyboss-app --fields=name,status,version,update,update_version

# Use the configured vendor update channel when available
wp plugin update buddyboss-app

# Confirm the installed version after updating
wp plugin get buddyboss-app --field=version

If the plugin slug differs in your licensed package, identify it without changing the site:

wp plugin list --fields=name,status,version,update,update_version | grep -i buddyboss

Indicators and investigation

Unexpected requests to BuddyBoss App feedback endpoints, especially from newly created or low-privilege accounts.
PHP, PHTML, PHAR or oddly named files in WordPress upload or temporary directories.
Feedback attachments remaining after failed wp_mail() events.
Mail transport errors occurring near suspicious upload requests.
New administrator accounts, unfamiliar plugins or must-use plugins, modified scheduled tasks, or changes to the site URL and administrator email.
Web-server child processes launching shells, download utilities or outbound network connections.

# Read-only search for executable extensions beneath uploads
find wp-content/uploads -type f \( -iname '*.php' -o -iname '*.phtml' -o -iname '*.phar' \) -print

# Review recently registered users and their roles
wp user list --fields=ID,user_login,user_email,roles,user_registered --orderby=registered --order=DESC

# Verify WordPress core files while investigating possible compromise
wp core verify-checksums

Do not delete suspicious files before recording paths, timestamps, hashes and related access-log entries. A failed upload or mail error alone does not prove code execution, but an executable file in a web-accessible directory warrants incident response.

Practical verification checklist

Confirm BuddyBoss App reports version 3.2.2 or newer.
Test that normal app feedback still works after updating.
Confirm the web server does not execute scripts from upload and temporary directories.
Review feedback, mail and web-server logs from at least November 2, 2026 onward.
Inspect recent users and invalidate suspicious sessions.
Run a trusted malware and integrity scan after the version update.

BuddyBoss App through 3.2.1 – Subscriber+ Arbitrary File Upload to RCE (CVE-2026-76124)