Buddyboss App
Monthly
Authenticated arbitrary file upload in the BuddyBoss App plugin for WordPress, affecting all versions through 3.2.1, lets any subscriber-level user or higher submit files through the send_feedback function, which trusts only the client-supplied Content-Type header and performs no server-side content or extension validation. Uploaded files may be executable, so the defect can lead to remote code execution, but the assessed vector is AC:H because reliable code execution depends on winning a race during the SMTP/email-send window before the file is deleted, or on wp_mail() failing and leaving the file on disk indefinitely. No public exploit was identified at time of analysis, and the issue is not in CISA KEV.
Authenticated arbitrary file upload in the BuddyBoss App plugin for WordPress, affecting all versions through 3.2.1, lets any subscriber-level user or higher submit files through the send_feedback function, which trusts only the client-supplied Content-Type header and performs no server-side content or extension validation. Uploaded files may be executable, so the defect can lead to remote code execution, but the assessed vector is AC:H because reliable code execution depends on winning a race during the SMTP/email-send window before the file is deleted, or on wp_mail() failing and leaving the file on disk indefinitely. No public exploit was identified at time of analysis, and the issue is not in CISA KEV.