low3.7
CVE-2026-118437
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers…
Impact
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| ThemeKraft | BuddyForms | from 2.8.8 before 2.10.1 |
| Unknown | BuddyForms | from 2.8.8 before 2.10.1 |