CVE-2023-26326

CRITICAL

BuddyForms <2.7.8 - Insecure Deserialization

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2023-26326. PoCs published by omarelshopky, mesudmammad1.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2023-26326 (BuddyForms unauthenticated insecure deserialization) chained with CVE-2024-2961 (glibc iconv vulnerability) to achieve RCE on PHP 8.3.x systems. The exploit leverages `php://filter` to bypass deserialization gadget chain limitations and delivers a reverse shell.

Description

The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue. An unauthenticated attacker could leverage this issue to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.

Exploits (2)

nomisec WORKING POC 1 stars
by omarelshopky · poc
https://github.com/omarelshopky/exploit_cve-2023-26326_using_cve-2024-2961

This repository contains a functional exploit for CVE-2023-26326 (BuddyForms unauthenticated insecure deserialization) chained with CVE-2024-2961 (glibc iconv vulnerability) to achieve RCE on PHP 8.3.x systems. The exploit leverages `php://filter` to bypass deserialization gadget chain limitations and delivers a reverse shell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: WordPress BuddyForms Plugin < 2.7.8 on PHP 8.3.x
No auth needed
Prerequisites: Target running WordPress with BuddyForms < 2.7.8 · PHP 8.3.x with vulnerable glibc (CVE-2024-2961) · Network access to target's `/wp-admin/admin-ajax.php`
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by mesudmammad1 · poc
https://github.com/mesudmammad1/CVE-2023-26326_Buddyform_exploit

This repository contains a functional exploit for CVE-2023-26326, leveraging a deserialization vulnerability in the BuddyForms WordPress plugin. The exploit chains CVE-2024-2961 to achieve remote code execution via `php://filter` manipulation, bypassing PHP 8+ restrictions.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: BuddyForms WordPress plugin < 2.7.8
No auth needed
Prerequisites: Target running WordPress with BuddyForms plugin < 2.7.8 · PHP 8.3.x environment · Network access to the target
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 9.8
EPSS 0.0382
EPSS Percentile 88.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-502
Status published
Products (1)
themekraft/buddyforms < 2.7.8
Published Feb 23, 2023
Tracked Since Feb 18, 2026