# Advanced Form Integration <= 2.11.0 - Unauthenticated Privilege Escalation and Account Takeover via BuddyBoss Create/Update Member Action

- **ID:** WPSEC-2026-2488
- **Plugin:** Advanced Form Integration — Connect Forms to 300+ Apps (`advanced-form-integration`), https://wordpress.org/plugins/advanced-form-integration/
- **Affected versions:** all versions before 2.11.3
- **Fixed in:** 2.11.3 (Update to 2.11.3 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-269
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/advanced-form-integration
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2488/

## Description

The Advanced Form Integration plugin for WordPress is vulnerable to Privilege Escalation via the BuddyBoss "Create/Update Member" integration action in all versions up to, and including, 2.11.0. This is due to the adfoin_buddyboss_process_member() function passing the submitted role value to wp_insert_user()/wp_update_user() without restriction, and updating the email address, password and role of any existing account found by the submitted user ID, email or username without checking that it belongs to the user submitting the form. This makes it possible for unauthenticated attackers to create administrator accounts, or to take over existing accounts, including administrators, by changing their email address or password. Exploitation requires the site to have an active BuddyBoss member integration whose fields are mapped to submitted form values.

## References

- https://wpsec.com/vuln/WPSEC-2026-2488/
- https://plugins.svn.wordpress.org/advanced-form-integration/tags/2.11.3/
- https://wordpress.org/plugins/advanced-form-integration/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2488/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.