BuddyForms
| Version / range | Status | Type |
|---|---|---|
| 2.8.8 to before 2.10.1 | affected | semver |
Threat intelligence dashboard
CVE-2026-118437Unrated
BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.
Risk score
—
CVSS unavailable
- Vendor
- Not available
- Product
- BuddyForms
- CWE
- CWE-73
- Published
- Oct 31, 2026
- Updated
- Oct 31, 2026
- CISA KEV
- Not flagged
Affected products and versions
Technical metrics
No CVSS metrics were provided.