BuddyBoss App CVE-2026-76124

Requires an authenticated account with at least subscriber-level privileges (PR:L) on a site running BuddyBoss App plugin ≤ 3.2.1, exploited via the send_feedback function, which performs no server-side content inspection or extension validation and trusts only the client-supplied Content-Type header. Reliable code execution is limited by two conditions stated in the advisory: the attacker must either win a race condition during the SMTP/email-send window before the uploaded file is deleted, or the wp_mail() call must fail (causing the file to persist indefinitely). The plain arbitrary-upload defect is reliable; the RCE outcome depends on these timing/failure conditions, which meaningfully constrain real-world exploitation despite the network vector.

This is a genuine high-priority issue but with an important reliability caveat that the raw 8.8 CVSS score obscures. The input CVSS vector (AV:N/AC:L/PR:L/UI:N) describes network-reachable exploitation by an authenticated user with only subscriber-level access (PR:L) - a very low bar on open-registration WordPress community sites, which is exactly BuddyBoss's use case, so the privilege requirement is weak protection. The file-type check is trivially bypassed because validation relies solely on the client-supplied Content-Type header, so uploading an executable PHP file is reliable. However, the description itself states that uploaded files are deleted after email transmission and that reaching the file for code execution depends on winning a race condition during SMTP execution, or on wp_mail() failing (in which case the file persists). That means arbitrary upload is reliable but the RCE step is conditional, which is why I assess attack complexity as higher than the input's AC:L. No EPSS score was provided and the vendor priority label is 'this_week' (not act_now/emergency), consistent with a serious-but-not-actively-mass-exploited finding. There is no public exploit identified in the supplied data and no CISA KEV listing. Net: prioritize patching to 3.2.2 within the vendor's this-week window - the low authentication bar plus RCE potential justify urgency - but the race-condition dependency makes mass automated exploitation less certain than the headline score suggests.

An attacker registers a free subscriber account on a BuddyBoss-powered community site, then submits the feedback feature (send_feedback) with a PHP payload whose Content-Type header is spoofed to a permitted type, bypassing the only validation present. If they win the race against the post-email deletion - or if wp_mail() fails so the file persists - they request the uploaded PHP file to achieve remote code execution. No public exploit code was identified in the available data.