CVE-2024-32830

WordPress buddyforms plugin <= 2.8.8- Arbitrary File Read and SSRF vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeKraft BuddyForms allows Server Side Request Forgery, Relative Path Traversal.This issue affects BuddyForms: from n/a through 2.8.8.

Affected

ThemeKraft · BuddyForms

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1 PATCHSTACK

8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS

0.58% chance of exploitation in the next 30 days, 47th percentile

Published

2024-05-17

Updated

2026-04-28

Proof-of-concept exploits (1)

• ptrstr/CVE-2024-32830-poc0★ · 2025-04-25

Security advisories

• https://patchstack.com/database/vulnerability/buddyforms/wordpress-buddyforms-plugin-2-8-…

References

• CVE Record
• NVD entry

Related

• CVE-2013-3900
• CVE-2025-4524