BuddyForms through 2.10.5 – Unauthenticated Administrator Privilege Escalation (CVE-2026-107622)

Patch immediately: BuddyForms versions through 2.10.5 are vulnerable to unauthenticated privilege escalation that can create an administrator account and lead to full site takeover. The vulnerability is tracked as CVE-2026-107622, has a CVSS score of 9.8, and is fixed in BuddyForms 2.10.6.

Exploit path and prerequisites

The public front-end submission handler authorizes logged-out submissions using a form’s public submission setting, but affected versions independently trust the submitted post type when creating a new object. The form-builder save path also lacked the required capability and nonce checks. Together, these weaknesses can let an unauthenticated attacker create a rogue BuddyForms registration configuration with a privileged role and then register an administrator account.

Wordfence states that exploitation requires the WordPress Anyone can register option to be enabled and at least one public BuddyForms form to be attached to a page. Those are normal configurations for sites using BuddyForms for registration or guest submissions.

Patch details

BuddyForms 2.10.6 forces front-end submissions to use the post type configured by the form, blocks anonymous registration from assigning roles that can manage the site or users, and adds nonce and permission checks when saving forms and form metadata. WordPress.org lists 2.10.6 as the current release.

Immediate remediation

1. Update BuddyForms to version 2.10.6 or later.
2. Until the update is verified, disable public BuddyForms submissions and turn off Anyone can register if the site does not require open registration.
3. Review recently created BuddyForms form objects and registration settings for unauthorized role assignments.
4. Audit all administrator accounts and remove unknown users only after preserving evidence.
5. Rotate credentials and WordPress salts if an unauthorized privileged account or rogue form configuration is found.

wp plugin get buddyforms --fields=name,status,version,update,update_version
wp plugin update buddyforms
wp option get users_can_register
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp post list --post_type=buddyforms --fields=ID,post_title,post_date,post_status --orderby=date --order=DESC

Temporary mitigation only: If the update cannot be installed immediately, deactivate BuddyForms or disable every public form and open user registration. This reduces the reachable attack surface but does not repair the vulnerable code.

Indicators of compromise

• Unexpected administrator accounts or a spike in new registrations.
• New or recently modified BuddyForms form objects that were not created by an authorized administrator.
• Registration forms assigning administrator or another management-capable role.
• Requests containing unexpected BuddyForms post-type or form-configuration parameters.
• Changes to users_can_register, default_role, BuddyForms options, plugins, scheduled tasks or theme files.

Verification

Confirm BuddyForms 2.10.6 or later is active, verify open registration matches the site’s intended policy, and test each legitimate public form. Review users and BuddyForms form records created before the update, with particular attention to activity around November 5, 2026 and later. If takeover is suspected, perform a full file, database and credential review rather than relying only on account cleanup.

Sources

• Wordfence Intelligence technical record
• BuddyForms release page and 2.10.6 changelog
• CVE-2026-107622 record