Is CVE-2026-76124 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76124 being exploited in the wild.

How severe is CVE-2026-76124?

High severity, with a CVSS score of 8.8, published 3 November 2026.

Which products and versions are affected?

BuddyBoss App up to and including 3.2.1.

Is there a fix for CVE-2026-76124?

Yes: fixed in 3.2.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76124 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-76124?

Check whether you run BuddyBoss App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76124: BuddyBoss App arbitrary file upload in send_feedback

CVE-2026-76124 · Severity: high · CVSS 8.8 · Published 2026-11-03

The BuddyBoss App is a WordPress plugin that helps site owners build mobile applications. Authenticated users can upload arbitrary executable files through the send_feedback function due to weak file validation, leading to remote code execution. Although files are normally deleted after email transmission, a race condition and email failures allow attackers to access or retain uploaded files indefinitely.

Vendors: BuddyBoss.

Quick answers

Is CVE-2026-76124 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76124 being exploited in the wild.
How severe is CVE-2026-76124?: High severity, with a CVSS score of 8.8, published 3 November 2026.
Which products and versions are affected?: BuddyBoss App up to and including 3.2.1.
Is there a fix for CVE-2026-76124?: Yes: fixed in 3.2.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76124 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-76124?: Check whether you run BuddyBoss App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.2.2

Technical details

The vulnerability exists in the send_feedback function's file upload handling, which validates file types only by checking the client-supplied Content-Type header without server-side inspection or extension validation. Authenticated attackers with subscriber-level access can upload executable files. While uploaded files are typically deleted after SMTP execution, a race condition during email transmission and persistent storage when wp_mail() fails enable arbitrary file access and remote code execution.

Affected products

BuddyBoss BuddyBoss App up to and including 3.2.1

Timeline

2026-11-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.