CVE-2024-1170

🗓️ 07 Mar 2024 11:01:57Reported by WordfenceType

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to arbitrary media file deletion

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2024-1170	7 Mar 202412:31	–	circl
CNNVD	WordPress Plugin buddyforms security vulnerability	7 Mar 202400:00	–	cnnvd
Cvelist	CVE-2024-1170 Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Deletion	7 Mar 202411:01	–	cvelist
EUVD	EUVD-2024-16938	3 Oct 202520:07	–	euvd
NVD	CVE-2024-1170	7 Mar 202411:15	–	nvd
Patchstack	WordPress BuddyForms Plugin <= 2.8.7 is vulnerable to Broken Access Control	7 Mar 202400:00	–	patchstack
Prion	Arbitrary file deletion	7 Mar 202411:15	–	prion
Positive Technologies	PT-2024-17196 · WordPress · The Post Form – Registration Form – Profile Form For User Profiles – Frontend Content Forms For User Submissions	7 Mar 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-1170	5 Feb 202505:27	–	redhatcve
Vulnrichment	CVE-2024-1170 Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Deletion	7 Mar 202411:01	–	vulnrichment

NVD

Vulners

Node

themekraft post_formRange<2.8.8wordpress

[
  {
    "vendor": "themekraft",
    "product": "Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.8.7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/380c646c-fd95-408a-89eb-3e646768bbc5
plugins	www.plugins.trac.wordpress.org/changeset/3046092/buddyforms/trunk
plugins	www.plugins.trac.wordpress.org/browser/buddyforms/trunk/includes/functions.php

08 Apr 2026 18:20Current

8.6High risk

Vulners AI Score8.6

CVSS 3.18.2

EPSS0.00501

SSVC

CWE-862