Threats tagged 'ghsa-7gvp-gcxq-58g5'

The BuddyForms WordPress plugin up to version 2.10.5 contains a critical privilege escalation vulnerability. This flaw allows unauthenticated attackers to create administrator accounts by exploiting a form-type confusion issue via the bf_post_type parameter. The vulnerability arises because the plugin authorizes frontend submissions based only on a public_submit flag and trusts attacker-supplied post type data for new objects, bypassing important checks. Additionally, a missing capability check and nonce validation in the save_post listener enable attackers to persist malicious form configurations that grant admin privileges upon user registration. Exploitation requires the WordPress site to have 'Anyone can register' enabled and at least one public BuddyForms form, which are common default settings.