CVE-2026-76124
Deferred Deferred - Pending Action

Arbitrary File Upload in BuddyBoss App WordPress Plugin

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: Wordfence

Description
The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content inspection or extension validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. While uploaded files are deleted after email transmission, a race condition exists during SMTP execution that allows access to the file, and files persist indefinitely when wp_mail() fails.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-76124
EUVD
EUVD-2026-115810

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
BuddyBoss BuddyBoss App 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The BuddyBoss App plugin for WordPress has a vulnerability in versions up to 3.2.1 that allows arbitrary file uploads due to weak file type validation. Attackers with subscriber-level access or higher can upload executable files by exploiting a race condition during SMTP execution. While files are normally deleted after email transmission, they may persist if wp_mail() fails, enabling remote code execution.

Detection Guidance

Check for unauthorized file uploads in WordPress directories, particularly in uploads folders. Review server logs for suspicious SMTP or file operations. Use WordPress plugins like Wordfence to scan for malicious files or unusual activity. Look for files with unexpected extensions or names in the uploads directory.

Impact Analysis

This vulnerability allows attackers to upload and execute malicious files on your WordPress site, potentially gaining control over it. Even with subscriber-level access, attackers could exploit this to run arbitrary code, steal data, or disrupt services. Persistent files during wp_mail() failures increase the risk of long-term compromise.

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or data exfiltration, violating GDPR and HIPAA requirements for data protection and access control. A successful exploit may result in non-compliance, legal penalties, and reputational damage due to compromised sensitive information.

Mitigation Strategies

Update the BuddyBoss App plugin to version 3.2.2 or later immediately. Disable the send_feedback function if not required. Implement server-side file validation and restrict file upload permissions. Monitor for unauthorized file uploads and review SMTP logs for anomalies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76124. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...