# CVE-2026-107622: BuddyForms privilege escalation via form-type confusion

Source: https://junglewise.ai/threats/cve-2026-107622-the-buddyforms-plugin-for-wordpress-is-vulnerable-to-privilege  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-107622 · Severity: critical · CVSS 9.8 · Published 2026-11-06

The BuddyForms plugin for WordPress is a form builder that allows site administrators to create public registration and submission forms. An unauthenticated attacker can exploit form-type confusion to inject a malicious form configuration into the site's form registry, then register a new user account with administrator privileges, resulting in complete site takeover. This attack works on standard WordPress deployments where public registration and at least one public BuddyForms form are enabled.

Technologies: [Themekraft Buddyforms](https://junglewise.ai/threats/technologies/themekraft-buddyforms). Vendors: [Themekraft](https://junglewise.ai/threats/vendors/themekraft).

## Quick answers

**Is CVE-2026-107622 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107622 being exploited in the wild.

**How severe is CVE-2026-107622?** Critical severity, with a CVSS score of 9.8, published 6 November 2026.

**Which products and versions are affected?** Themekraft Buddyforms up to and including 2.10.5.

**Is there a fix for CVE-2026-107622?** Yes: fixed in 2.10.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107622 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107622?** Check whether you run Themekraft Buddyforms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.10.6

## Technical details

The vulnerability combines multiple authorization flaws: the frontend submission handler trusts the attacker-supplied `bf_post_type` POST parameter to determine the post type of newly created objects, while the `save_post` hook handler lacks both capability checks and nonce validation. An unauthenticated attacker can submit a public form with a crafted `bf_post_type` to create a rogue BuddyForms form post, then inject an attacker-controlled `new_user_role` value set to administrator, and finally register through that malicious form to achieve account creation with elevated privileges. The vulnerability affects all versions up to 2.10.5, with the form-type cross-check introduced in 2.10.2 only protecting existing posts, not new-object creation.

## Affected products

- Themekraft BuddyForms up to and including 2.10.5

## Timeline

- 2026-11-06: disclosed
- 2026-10-19: patched: Fix merged via PR #779 on October 19, 2026; release date of fixed version inferred from disclosure date

## References

- [https://github.com/Themekraft/buddyforms/pull/779/files](https://github.com/Themekraft/buddyforms/pull/779/files)
- [https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.10.2/includes/admin/register-post-types.php](https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.10.2/includes/admin/register-post-types.php)

## Related threats

- [BuddyForms plugin for WordPress stored XSS via form parameters](https://junglewise.ai/threats/cve-2026-107658-the-buddyforms-plugin-for-wordpress-is-vulnerable-to-stored)
- [Missing Authorization vulnerability in Themekraft BuddyForms buddyforms allows Accessing Functionality Not Properly…](https://junglewise.ai/threats/cve-2025-62973-missing-authorization-vulnerability-in-themekraft-buddyforms)