CVE-2026-76124

The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the sendfeedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content...

CVE-2026-76124

The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to and including 3.2.1 . The flaw exists in the send_feedback function due to insufficient file type validation, which relies exclusively on the client-supplied Content-Type header without server-side...

CVE-2026-76124 BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpoint

The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the sendfeedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content...