The flaw allows an unauthenticated user to send a crafted request to BuddyForms’ public front‑end handler. By providing a value for the bf_post_type parameter, the attacker bypasses the post‑type cross‑check that normally protects new object creation. The plugin’s save_post callback then stores the attacker‑supplied options without verifying the current user or a nonce. When the form is used for user registration, the attacker can set the new_user_role to administrator, resulting in the creation of a WordPress account with full site‑wide administrative privileges. This is a form‑type confusion that enables unchecked privilege escalation.

BuddyForms for WordPress from themekraft is vulnerable in all releases up to and including version 2.10.5. WordPress sites running this plugin with the "Anyone can register" option enabled and at least one publicly accessible form are affected by the described flaw.

The CVSS score of 9.8 marks this as a critical vulnerability. An exploit requires only that the site allows user registration and has a public form, conditions that are common in typical BuddyForms deployments, so the attack is straightforward. The EPSS score is not available, and the flaw is not listed in CISA KEV, but the severity and potential to create an administrator account make it a top‑priority risk for affected installations.