Advanced Form Integration <= 2.11.0 - Unauthenticated Privilege Escalation and Account Takeover via BuddyBoss Create/Update Member Action
- ID
- WPSEC-2026-2488
- Plugin
- Advanced Form Integration — Connect Forms to 300+ Apps (advanced-form-integration)
- Affected
- all versions before 2.11.3
- Remediation
- Update to 2.11.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-269
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-04
- Attack surface
- Advanced Form Integration on WPSec AttackSurface
- Fix released
- Published
Description
The Advanced Form Integration plugin for WordPress is vulnerable to Privilege Escalation via the BuddyBoss "Create/Update Member" integration action in all versions up to, and including, 2.11.0. This is due to the adfoin_buddyboss_process_member() function passing the submitted role value to wp_insert_user()/wp_update_user() without restriction, and updating the email address, password and role of any existing account found by the submitted user ID, email or username without checking that it belongs to the user submitting the form. This makes it possible for unauthenticated attackers to create administrator accounts, or to take over existing accounts, including administrators, by changing their email address or password. Exploitation requires the site to have an active BuddyBoss member integration whose fields are mapped to submitted form values.
References
- https://wpsec.com/vuln/WPSEC-2026-2488/
- https://plugins.svn.wordpress.org/advanced-form-integration/tags/2.11.3/
- https://wordpress.org/plugins/advanced-form-integration/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS