CVE-2024-8246 Privilege escalation in Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)

High 8.8 Published 14 Sep 2024 Updated 8 Apr 2026

Authenticated contributors can escalate privileges to administrator by manipulating default role settings in registration forms.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-8246?

CVE-2024-8246 is a high-severity vulnerability in themekraft Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC), published on 14 Sep 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.8.11. This is due to plugin not properly restricting what users have access to set the default role on registration forms. This makes it possible for authenticated attackers, with contributor-level access and above, to create a registration form with a custom role that allows them to register as administrators.

Weakness: CWE-269

Which versions are affected by CVE-2024-8246?

It affects 1 product.

Products include Themekraft Buddyforms.

How do I fix CVE-2024-8246?

No fix has been published for CVE-2024-8246 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-8246 being exploited?

There is no known exploitation of CVE-2024-8246 in the wild and no public exploit code.

Sources

Also known as GHSA-3f92-cwf9-rgvq.