{
 "id": "WPSEC-2026-2488",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2488/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2488/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2488/index.md",
 "title": "Advanced Form Integration <= 2.11.0 - Unauthenticated Privilege Escalation and Account Takeover via BuddyBoss Create/Update Member Action",
 "description": "The Advanced Form Integration plugin for WordPress is vulnerable to Privilege Escalation via the BuddyBoss \"Create/Update Member\" integration action in all versions up to, and including, 2.11.0. This is due to the adfoin_buddyboss_process_member() function passing the submitted role value to wp_insert_user()/wp_update_user() without restriction, and updating the email address, password and role of any existing account found by the submitted user ID, email or username without checking that it belongs to the user submitting the form. This makes it possible for unauthenticated attackers to create administrator accounts, or to take over existing accounts, including administrators, by changing their email address or password. Exploitation requires the site to have an active BuddyBoss member integration whose fields are mapped to submitted form values.",
 "plugin": {
  "slug": "advanced-form-integration",
  "name": "Advanced Form Integration",
  "full_name": "Advanced Form Integration — Connect Forms to 300+ Apps",
  "wordpress_org": "https://wordpress.org/plugins/advanced-form-integration/",
  "advisories_url": "https://wpsec.com/vuln/plugin/advanced-form-integration/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/advanced-form-integration"
 },
 "type": "PRIV",
 "cwe": [
  "CWE-269"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.11.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.11.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.11.3",
 "remediation": "Update to 2.11.3 or later.",
 "fix_released": "2026-11-03T10:42:32+00:00",
 "published": "2026-11-04T14:58:24+00:00",
 "updated": "2026-11-04T13:58:57.436001+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2488/",
  "https://plugins.svn.wordpress.org/advanced-form-integration/tags/2.11.3/",
  "https://wordpress.org/plugins/advanced-form-integration/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/advanced-form-integration",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-04"
 }
}