BuddyForms <= 2.7.7 — PHAR Deserialization

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under BuddyForms.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 2.7.8, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch BuddyForms to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Joshua Martinelle.

The BuddyForms plugin for WordPress is vulnerable to deserialization of untrusted input via the 'url' parameter in versions up to, and including 2.7.7. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload, however, this can easily be achieved by uploading a fake profile photo prior to launching an attack.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Feb 20, 2023

   CVE published

   Severity high, CVSS 8.8

2. Nov 13, 2026

   Record last updated