BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter

Overview

The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the bf_post_type parameter. This is due to the public frontend submission handler buddyforms_form_response_no_ajax() authorizing logged-out submissions based solely on the target form's public_submit flag while independently trusting the attacker-supplied $_POST['bf_post_type'] to determine the post type of the newly created object — a cross-check introduced in 2.10.2 applies only to existing posts (post_id != 0) and is completely bypassed for new-object creation — combined with the save_post listener buddyforms_edit_form_save_meta_box_data() lacking both a current_user_can() capability check and a form-builder nonce, causing it to unconditionally persist attacker-supplied $_POST['buddyforms_options'] for any newly inserted buddyforms CPT post. This makes it possible for unauthenticated attackers to insert a rogue BuddyForms form configuration with an attacker-controlled new_user_role value into the live global form registry, then submit a registration through that form to create a new WordPress account with administrator-level privileges and achieve full site takeover. Exploitation requires the WordPress site to have "Anyone can register" enabled and at least one public BuddyForms form attached to a page, both of which are standard BuddyForms deployment configurations.

Affected

• BuddyForms <= 2.10.5

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.