CVE-2024-5149 is a vulnerability in the themekraft BuddyForms WordPress plugin that allows email verification bypass due to the use of insufficiently random activation codes (CWE-330). This flaw affects the plugin's user registration and content submission forms, enabling unauthenticated attackers to circumvent email verification mechanisms. The vulnerability is present in all versions up to 2.8.9. The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. No patch or official remediation guidance is currently documented.

An attacker can bypass the email verification process in the BuddyForms plugin, potentially allowing unverified or malicious accounts to be created or content to be submitted without proper validation. This could lead to unauthorized access or manipulation of user profiles and frontend content submissions. The confidentiality and integrity of the system may be partially compromised, but availability is not affected. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting the affected forms or implementing additional verification controls externally to mitigate the risk of email verification bypass. Monitor the vendor's communications for updates and apply patches promptly once available.