CVE-2026-118437

BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion

low · 3.7

Fix listed

Published Oct 31, 2026, 06:00 UTC

Description

The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.

Reported fixed versions

2.10.1

Official CVE record View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.