CVE-2026-76124: BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpoint
The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the sendfeedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content inspection or extension validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. While uploaded files are deleted after email transmission, a race condition exists during SMTP execution that allows access to the file, and files persist indefinitely when wpmail() fails.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must be authenticated and have at least Subscriber-level access. No user interaction is required after the attacker has that access.
When can an uploaded file remain accessible?
Files are normally deleted after email transmission, but they may be accessible during SMTP processing because of a race condition. If wp_mail() fails, uploaded files can persist indefinitely.
What makes the upload validation bypass possible?
The feedback endpoint relies only on the client-supplied Content-Type header and does not perform server-side content inspection or extension validation. An authenticated attacker can therefore submit a file that may be executable while claiming an allowed content type.