CVE-2026-118437
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments. This allows unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.
Risk Assessment
An attacker can delete files uploaded by other users, causing data loss and service disruption. This may affect the integrity and availability of content.
Recommendation
Update the BuddyForms plugin to version 2.10.1 or later. Check whether uploaded files have been deleted without authorization.
Other vulnerabilities in BuddyForms
See all- CVE-2026-81785Medium
The BuddyForms plugin in versions up to and including 2.9.0 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. Missing proper access control allows operations that a user should not be permitted to perform.
- CVE-2026-118101Medium
The BuddyForms plugin for WordPress before 2.10.1 does not verify that a user editing an existing entry is the author of the target post. This allows users with edit access to a form, as low as Subscriber, to overwrite the title, content, and status of any other user's posts or pages, including those of administrators.
- CVE-2026-118100Medium
The BuddyForms plugin for WordPress before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configuration. This allows unauthenticated users to download any form's stored settings, including notification recipient email addresses and reCAPTCHA secret keys.
- CVE-2025-62973Medium
BuddyForms (Themekraft plugin) up to version 2.10.2 contains a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. Attackers can exploit this for unauthorized operations.
- CVE-2025-32151High
The BuddyForms plugin (up to version 2.10.2) contains a PHP Local File Inclusion vulnerability due to improper control of filename for include/require statement.
Original NVD description (English source)
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS