CVE-2024-8246: BuddyForms Privilege Escalation Vulnerability

CVE-2024-8246 Overview

CVE-2024-8246 is a privilege escalation vulnerability in the BuddyForms plugin for WordPress, developed by Themekraft. The plugin, marketed as "Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)," fails to properly restrict which users can set the default role on registration forms. Authenticated attackers with contributor-level access or above can create a registration form that assigns the administrator role. All versions up to and including 2.8.11 are affected.

Critical Impact
Contributor-level users can register new accounts with administrator privileges, resulting in full compromise of the WordPress site.

Affected Products

Themekraft BuddyForms plugin for WordPress
All versions up to and including 2.8.11
Sites where contributor-level or higher accounts exist alongside the plugin

Discovery Timeline

2024-09-14 - CVE-2024-8246 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8246

Vulnerability Analysis

The vulnerability is a broken access control flaw classified under [CWE-269] Improper Privilege Management. BuddyForms exposes registration form configuration to users who should not control account provisioning. The form builder includes a field that determines which WordPress role is assigned to accounts created through the form. The plugin does not verify that the acting user holds a capability equivalent to manage_options or promote_users before accepting that role value.

A contributor-level attacker abuses this gap by creating or editing a BuddyForms registration form and setting the default role to administrator. The attacker then submits the front-end registration form to create a new account. The newly registered account inherits the administrator role and gains full control over the WordPress installation, including plugin installation, theme editing, and arbitrary PHP execution.

The issue requires only low-privileged authentication and no user interaction, and it impacts confidentiality, integrity, and availability of the target site.

Root Cause

The plugin's registration metabox handler in includes/admin/form-builder/meta-boxes/metabox-registration.php accepts the default-role parameter without validating the current user's capability to assign that role. The fix committed in changeset 3149760 adds a capability check that constrains selectable roles to those the current user is permitted to grant.

Attack Vector

The attack is remote and requires an authenticated session with contributor privileges or higher. Contributor accounts are commonly available on multi-author WordPress sites and guest-post platforms, and they are also frequently obtained through weak password reuse or credential stuffing. Once authenticated, the attacker reaches the BuddyForms form-builder UI, creates a registration form with the administrator role selected, and completes the escalation by submitting that form.

No verified public exploit code is available. The vulnerability mechanism is documented in the WordPress BuddyForms Change Log and the Wordfence Vulnerability Report #40760.

Detection Methods for CVE-2024-8246

Indicators of Compromise

New WordPress users with the administrator role created shortly after a contributor account edited or created a BuddyForms form.
Unexpected entries in wp_options or BuddyForms custom post types where the registration form role field is set to administrator.
Access log entries showing contributor accounts making POST requests to admin.php?page=buddyforms or the form-builder AJAX endpoints, followed by anonymous requests to the front-end registration page.
Installation of unfamiliar plugins or themes, or modifications to wp-config.php and theme files, immediately after new account creation.

Detection Strategies

Audit the WordPress users table for administrators created after the plugin was installed and correlate creation timestamps with BuddyForms form submissions.
Inspect every BuddyForms registration form for a default role of administrator, editor, or any role above the form owner's own capability level.
Enable WordPress activity logging to record form creation, form updates, and role assignments performed by non-administrator users.

Monitoring Recommendations

Alert on user_register events where the assigned role is administrator and the request originates from a public-facing form endpoint.
Monitor web server logs for repeated access to BuddyForms admin pages by contributor or author accounts.
Track file integrity on wp-content/plugins and wp-content/themes to detect post-compromise persistence.

How to Mitigate CVE-2024-8246

Immediate Actions Required

Update BuddyForms to version 2.8.12 or later on every WordPress site where the plugin is installed.
Review all existing BuddyForms registration forms and remove any that assign privileged roles created by non-administrator users.
Audit the WordPress user list and demote or remove any administrator accounts that cannot be attributed to a legitimate administrator action.
Rotate credentials for all administrator accounts and force a password reset for contributor-level and above accounts.

Patch Information

Themekraft addressed the flaw in BuddyForms 2.8.12, tracked in WordPress plugin changeset 3149760. The patch adds a capability check in metabox-registration.php so that only users with role-management privileges can assign privileged roles on a registration form.

Workarounds

If patching is not immediately possible, deactivate the BuddyForms plugin until the update can be applied.
Restrict access to the form-builder screens by removing form-editing capabilities from contributor and author roles using a role-management plugin.
Disable open registration site-wide in Settings → General to blunt the impact of any privileged registration form that may have been created.
Place the WordPress admin area behind an IP allow-list or additional authentication factor while remediation is in progress.

bash

# Verify the installed BuddyForms version via WP-CLI and update if vulnerable
wp plugin get buddyforms --field=version
wp plugin update buddyforms --version=2.8.12

# List all administrator accounts for review
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered