Security notice
Public BuddyForms forms on WordPress? A flaw can let someone create an administrator account. Update to 2.10.6.
BuddyForms versions 2.10.5 and earlier have CVE-2026-107622, an unauthenticated privilege escalation to administrator flaw. Someone without a login can create an account with administrator permissions and take over the site. Update to 2.10.6 or later today. If you cannot update, deactivate the plugin until you can. (Patchstack, CVE record)
What happened
- The flaw. CVE-2026-107622 affects BuddyForms through 2.10.5. Someone without a login can create an account with administrator permissions and take over the site. (Patchstack, CVE record)
- The fix. Patchstack lists 2.10.6 as the patched version. Update to that version or later. (Patchstack)
- Severity. CVSS 9.8 (Wordfence and Patchstack). Patchstack calls it high priority and expected to become exploited. That wording is a warning about risk, not a report of attacks. (Patchstack, CVE record)
Who should worry
Wordfence's CVE record says exploitation requires BOTH WordPress's "Anyone can register" setting to be on AND at least one public BuddyForms form attached to a page. Update all older installations anyway; a setting or page can change later. (CVE record)
WordPress.org lists 800+ active installations. That is a plugin installation count, not a count of affected or compromised sites. (WordPress.org)
What to do now
- Update to 2.10.6 or later today. Back up the site and database first, then update the plugin through WordPress. (Patchstack)
- If the update has to wait, deactivate the plugin until you can install the fixed version. Check which forms or login features this pauses before leaving the site unattended.
- Check accounts and files. Check the Users screen for unexpected administrator accounts. Investigate accounts and role changes you did not authorize. Updating closes the flaw; it does not undo access an attacker may already have gained.
- Test the site. Check the pages that use this plugin after updating.
What to send your developer, agency or host
Please check whether our WordPress site runs BuddyForms. CVE-2026-107622 affects versions 2.10.5 and earlier; it is an unauthenticated privilege escalation to administrator flaw, fixed in 2.10.6+. Wordfence's CVE record says exploitation requires BOTH WordPress's "Anyone can register" setting to be on AND at least one public BuddyForms form attached to a page. Update all older installations anyway; a setting or page can change later. Please update today, or deactivate until the update can be installed. Check the Users screen for unexpected administrator accounts. Investigate accounts and role changes you did not authorize. Please confirm the version you left us on. Sources: Patchstack, CVE record.
Common questions
Does this mean my site was hacked?
No. A vulnerable version is a reason to update and review the site, not proof of a break-in.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We cannot see which WordPress plugins your site runs or which versions they are on. A scan without a warning about this plugin does not mean your site is safe.
Where can I follow updates?
Follow Patchstack, the CVE record and the plugin page on WordPress.org. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Patchstack: CVE-2026-107622, affected through 2.10.5, fixed in 2.10.6, published November 6, 2026.
- CVE record: CVE-2026-107622. Wordfence-assigned record, including deployment conditions and impact.
- WordPress.org: plugin version information and 800+ active installations.