{"id":"CVE-2026-76124","title":"BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpoint","summary":"The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-s…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-434"],"vendor":"BuddyBoss","product":"BuddyBoss App","affected":["app <= 3.2.1"],"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T12:31:54.695Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-76124","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56a1219c-1163-4867-b426-7ffe9ca5dcb5?source=cve"},{"url":"https://buddyboss.com/resources/buddyboss-app-plugin-releases/3-2-2/"}],"tags":["cve.org"],"epss":0.00437,"epssPercentile":0.38146,"ingestedAt":"2026-11-05T19:30:42.942Z","slug":"CVE-2026-76124","body":"## Overview\n\nThe BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content inspection or extension validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. While uploaded files are deleted after email transmission, a race condition exists during SMTP execution that allows access to the file, and files persist indefinitely when wp_mail() fails.\n\n## Affected\n\n- `app <= 3.2.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}