Public vulnerability disclosure

CVE-2026-118437

publishedCWE-73

The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.

Investigate in Cyber JSON Markdown

Technical severity3.7 lowCVSS 3.1 · NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Published2026-10-31Source updated 2026-11-01

Collected2026-11-021 attributed source

Fixes and workarounds

No remediation reported in collected sources.

Missing remediation information is not evidence that no patch exists.

Affected products and versions

No affected-product ranges reported in collected sources.

CVSS assessments

CVSS scores, vectors and reporting authorities
Version / score	Vector	Authority
3.1 / 3.7 low	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N`	NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References

https://wpscan.com/vulnerability/20a483cf-7003-4d5a-9abb-afcc3f985ee4/[email protected]