CVE-2026-118437

BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion

The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.

Affected

BuddyForms

CVSS v3.1 CNA

3.7 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.21% chance of exploitation in the next 30 days, 11th percentile

Published

2026-10-31

Updated

2026-11-01

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/20a483cf-7003-4d5a-9abb-afcc3f985ee4/find archive

CVE references

• https://wpscan.com/vulnerability/20a483cf-7003-4d5a-9abb-afcc3f985ee4REFERENCE

References

• CVE Record
• NVD entry