CVE-2026-81785
MediumCVSS 6.5Summary
The BuddyForms plugin in versions up to and including 2.9.0 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. Missing proper access control allows operations that a user should not be permitted to perform.
Risk Assessment
An unauthenticated attacker can bypass access control mechanisms and perform unauthorized actions on the WordPress site. This may lead to data modification or exposure of resources.
Recommendation
Update the BuddyForms plugin to a version newer than 2.9.0 that includes the access control fix. Until then, consider restricting access to the plugin's functionality.
Other vulnerabilities in BuddyForms
See all- CVE-2026-118437Low
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments. This allows unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.
- CVE-2026-118101Medium
The BuddyForms plugin for WordPress before 2.10.1 does not verify that a user editing an existing entry is the author of the target post. This allows users with edit access to a form, as low as Subscriber, to overwrite the title, content, and status of any other user's posts or pages, including those of administrators.
- CVE-2026-118100Medium
The BuddyForms plugin for WordPress before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configuration. This allows unauthenticated users to download any form's stored settings, including notification recipient email addresses and reCAPTCHA secret keys.
- CVE-2025-62973Medium
BuddyForms (Themekraft plugin) up to version 2.10.2 contains a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. Attackers can exploit this for unauthorized operations.
- CVE-2025-32151High
The BuddyForms plugin (up to version 2.10.2) contains a PHP Local File Inclusion vulnerability due to improper control of filename for include/require statement.
Original NVD description (English source)
Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS