CVE-2023-26326 Deserialization in BuddyForms WordPress Plugin
Unauthenticated attackers can achieve arbitrary code execution via insecure deserialization in the BuddyForms WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-26326?
CVE-2023-26326 is a critical unsafe deserialization vulnerability in BuddyForms WordPress Plugin, published on 23 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue. An unauthenticated attacker could leverage this issue to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.
Weakness: CWE-502
Which versions are affected by CVE-2023-26326?
It affects 1 product.
Products include Themekraft Buddyforms.
How do I fix CVE-2023-26326?
No fix has been published for CVE-2023-26326 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2023-26326 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-26326 exists.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in BuddyForms WordPress Plugin
- CVE-2018-21003 SQL injection in n/a
- CVE-2024-8246 Privilege escalation in Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)
- CVE-2024-32830 WordPress buddyforms plugin <= 2.8.8- Arbitrary File Read and SSRF vulnerability
- CVE-2025-32151 WordPress BuddyForms plugin <= 2.10.2 - Local File Inclusion vulnerability
- CVE-2024-5149 BuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomness
Sources
Also known as GHSA-c4hp-hwrc-92r3.