BuddyBoss Platform: Privilege escalation for subscribers in WordPress plugin

Summary

The WordPress plugin BuddyBoss Platform up to and including version 3.5.0 contains a privilege escalation vulnerability (CWE-266). An attacker with a low-privileged Subscriber account can gain higher privileges, potentially up to administrator and full control of the website. The attack is possible over the network without user interaction, so sites with open registration are at highest risk.

Affected

• BuddyBoss Platform (WordPress plugin) up to and including 3.5.0
• Product status in the threatint record is contradictory ("unaffected" and "any version affected"); treat as affected until the vendor advisory says otherwise

Fixed in

Unknown. No fixed version or vendor patch was confirmed in the available sources.

Workaround

• Disable open subscriber self-registration on sites that do not need it, or require approval for new accounts
• Check the Patchstack page for any virtual patch or firewall rule it offers
• No vendor-confirmed workaround is available

Exploitation

• Patchstack rates the vulnerability as high priority and expects exploitation; CISA SSVC lists exploitation as none and automatable as no
• No public exploit or CISA KEV entry was identified at time of analysis
• EPSS: 0.36 % (percentile 30)

Our recommendation

• Check the installed BuddyBoss Platform version on every WordPress site
• Disable open subscriber registration where it is not needed until a fix is applied
• Audit recently created accounts and recent changes to user roles and capabilities
• Update BuddyBoss Platform as soon as a fixed version is published, and check the Patchstack and vendor release notes
• Re-check NVD and Patchstack for updates, as the NVD entry is still deferred

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory CVE-2026-118082 patchstack.com
• Strix CVE-2026-118082 www.strix.ai
• threatint CVE-2026-118082 cve.threatint.com
• vuln.today privilege escalation vuln.today
• WPScan BuddyBoss Platform wpscan.com
• BuddyBoss Platform GitHub wiki github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:05.