BuddyForms plugin allows unauthenticated administrator takeover
Identifiers: CVE-2026-107622
- Published
- Last substantive change
- Last verified
Last verified: . Attention items are due for re-verification within 72 hours.
Summary
Wordfence disclosed CVE-2026-107622 on 5 November 2026 in the BuddyForms WordPress plugin, affecting versions 2.10.5 and earlier. Version 2.10.6 is patched; the vendor readme dated 19 October 2026 lists matching security fixes.
Impact
An unauthenticated attacker can create a rogue form configuration, register a new Administrator account and take over the site.
Who is affected
Only sites running BuddyForms 2.10.5 or earlier with both WordPress Anyone can register enabled and at least one public BuddyForms form attached to a page. Other WordPress sites are not affected by this issue.
Products and versions
| Products and versions | Affected | Fixed |
|---|---|---|
| BuddyForms | <= 2.10.5 | 2.10.6 |
Exploitation evidence
Exploitation not established. The sources reviewed on 6 November 2026 do not establish observed exploitation. The issue requires no login, so affected sites should update promptly.
Actions
- Take a backup, check compatibility, then update BuddyForms to 2.10.6 or a newer patched release.
- If updating must wait, have your provider temporarily disable the vulnerable public submission or registration path and confirm the business impact; this is not a guaranteed fix.
- Review recent Administrator and new user accounts and rogue form configurations, retain logs and triage any findings. Updating does not remove accounts created earlier.
Unknowns
- Disclosure on 5 November came after the 19 October fix; the advisory alone cannot show whether a site was compromised earlier.
- No observed exploitation is established in the reviewed sources, which is not proof that none exists.
Sources
- Wordfence Intelligence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/buddyforms/buddyforms-2105-unauthenticated-privilege-escalation-to-form-type-confusion-via-bf-post-type-parameter
- Themekraft / WordPress.org https://plugins.svn.wordpress.org/buddyforms/trunk/readme.txt
Change history
- — Published: Added 6 November 2026 from the Wordfence advisory of 5 November 2026 and the vendor 2.10.6 readme.