The BuddyBoss App plugin for WordPress accepts file uploads through its send_feedback function without sufficient server‑side validation. The plugin only looks at the Content‑Type header supplied by the client, ignoring the actual file content or extension. Because the endpoint is accessible to any WordPress user with the subscriber role or higher, an attacker logged in as such a user can upload a malicious file that is later executed by the server. This flaw permits remote code execution even though the file is normally deleted after the email is sent; a race condition in the SMTP handling can expose the file for download, and if wp_mail() fails the file remains on the server indefinitely.

BuddyBoss BuddyBoss App plugin for WordPress versions up to and including 3.2.1 are affected. The vulnerability exists in all installations of this plugin that use the send_feedback endpoint.

The flaw has a CVSS score of 8.8, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. Because the attacker must be authenticated and possess at least subscriber privileges, the attack vector is local and requires legitimate access. Nonetheless, once many users are compromised within an organization, the risk of a lateral jump to remote code execution is significant.