External risk intelligence

BuddyForms Privilege Escalation Allows Administrator Account Creation

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-107622

The vulnerability exists in a WordPress plugin component specifically designed for public frontend form submissions. Because it involves public-facing registration forms that are intended to be accessible to anonymous users over the internet, it is inherently exposed by design in standard deployments.

Privilege Escalation

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE describes a critical vulnerability in the BuddyForms WordPress plugin that could allow unauthenticated attackers to gain administrator privileges. The flaw stems from how the plugin handles form submissions, potentially enabling attackers to create new administrative accounts on affected WordPress sites, provided certain standard configuration settings are enabled.

Attackers can create admin accounts on sites.
Important for sites using BuddyForms registration forms.
Confirm if BuddyForms is used and needs review.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit a weakness in how form submissions are handled to gain administrative privileges on a WordPress site. This attack starts by identifying a public BuddyForms form on the site, which is accessible to anyone, including logged-out users. By manipulating specific form data, the attacker can trick the plugin into creating a new form configuration that, when used for registration, assigns administrator rights to the new user.

No authentication required.
Submit crafted form data.
Full site takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to create new administrator accounts on a WordPress site. This is possible when the site has user registration enabled and a public BuddyForms form is available, enabling attackers to submit a crafted form to gain full control of the website.

Administrator accounts on the WordPress site.
Crafting form submissions to execute commands.
Full site takeover by an attacker.

Operational Fix

Recommended remediation, mitigation, and detection steps

Platform teams managing WordPress and security teams are likely responsible for this vulnerability. The first practical step is to identify all WordPress instances utilizing the BuddyForms plugin, confirm which are publicly accessible and critical to business operations, and then determine the accountable owner for remediation planning.

Platform and Security teams own resolution.
Verify public forms and registration settings.
Plan remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the BuddyForms plugin for WordPress?

BuddyForms is a plugin used to build custom front-end forms for WordPress. It allows site owners to let visitors create posts, manage user profiles, or register new accounts directly from the website's public pages without needing to access the WordPress administrative dashboard.

How does CVE-2026-107622 work?

This vulnerability is a Privilege Escalation flaw, classified under CWE-269. It occurs because the plugin fails to properly verify the identity of users submitting form data. An attacker can manipulate specific form parameters to trick the system into creating a rogue registration configuration that grants administrator privileges to any new account created through it.

When does this vulnerability trigger?

The flaw is triggered when an unauthenticated user submits crafted data to a public BuddyForms form. It requires the WordPress site to have the 'Anyone can register' setting enabled and at least one public BuddyForms form active. Submitting a standard, non-malicious form does not trigger this issue; the attacker must intentionally send manipulated form data to the plugin's submission handler.

Is my site at risk according to Halo Surface Signal?

Yes, Halo Surface Signal flags this as very likely to be reachable because the vulnerability resides in a component designed for public, internet-facing submissions. Since BuddyForms is often deployed specifically to allow anonymous users to interact with the site, the vulnerable entry point is frequently exposed by design.

What steps should I take if I use BuddyForms?

Start by identifying all WordPress instances where BuddyForms is installed. Verify if 'Anyone can register' is enabled and check if any public forms are active. Coordinate with your technical team to review the plugin status and prioritize remediation, as this configuration combination is necessary for the vulnerability to be successfully leveraged.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.