CVE-2026-118437

The BuddyForms WordPress plugin (versions 2.8.8 through 2.10.0 ) is vulnerable to an unauthenticated guest attachment deletion flaw. The software fails to properly verify ownership before processing the deletion of attachments uploaded by guests. This oversight allows unauthenticated attackers to...