{"affected":[],"cveId":"CVE-2026-118437","cwes":["CWE-73"],"description":"The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":3.7,"severity":"low","source":"NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1793557031107,"publishedAt":1793427393703,"references":[{"source":"contact@wpscan.com","tags":[],"url":"https://wpscan.com/vulnerability/20a483cf-7003-4d5a-9abb-afcc3f985ee4/"}],"remediation":[],"revision":"ce527e3c7939b7bbbfa71a2277947fbbbc4b6f4e1c263e2daa5ce3ea741e9285","sources":[{"modifiedAt":1793557031107,"name":"NVD","retrievedAt":1793578551978,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118437"}],"ssvc":{"assessedAt":1793554066715,"automatable":"no","exploitation":"none","source":"NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0","technicalImpact":"partial"},"status":"published","title":"CVE-2026-118437","updatedAt":1793578551978}