Description
The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue. An unauthenticated attacker could leverage this issue to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | BuddyForms WordPress Plugin | All versions prior to version 2.7.8 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
omarelshopky/exploit_cve-2023-26326_using_cve-2024-2961 ★ 1 · Feb 2, 2025
Exploit for CVE-2023-26326 in the WordPress BuddyForms plugin, leveraging CVE-2024-2961 for remote code execution. This exploit bypasses PHP 8+ deserialization limitations by chaining vulnerabilities…
-
mesudmammad1/CVE-2023-26326_Buddyform_exploit ★ 0 · Feb 12, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.