BuddyForms WordPress Plugin Privilege Escalation Vulnerability

The BuddyForms plugin for WordPress is vulnerable to privilege escalation in all versions up to and including 2.10.5. A form-type confusion attack through the bf_post_type parameter lets unauthenticated attackers achieve full site takeover.

The public frontend submission handler buddyforms_form_response_no_ajax() authorizes logged-out submissions based solely on the target form's public_submit flag while trusting attacker-supplied bf_post_type to determine the post type of newly created objects. The cross-check added in 2.10.2 applies only to existing posts (post_id != 0) and is completely bypassed for new-object creation. The save_post listener buddyforms_edit_form_save_meta_box_data() also lacks a current_user_can() capability check and a form-builder nonce, so it unconditionally persists attacker-supplied buddyforms_options for any newly inserted buddyforms CPT post.

• Attackers can insert a rogue BuddyForms form configuration with an attacker-controlled new_user_role value into the live global form registry.
• Submitting a registration through that form creates a new WordPress account with administrator-level privileges, leading to full site takeover.
• Exploitation requires the site to have 'Anyone can register' enabled and at least one public BuddyForms form attached to a page, both standard deployment configurations.