CVE-2026-118437

The BuddyForms WordPress plugin (versions 2.8.8 through 2.10.0 ) is vulnerable to an unauthenticated guest attachment deletion flaw. The software fails to properly verify ownership before processing the deletion of attachments uploaded by guests. This oversight allows unauthenticated attackers to...

CVE-2026-118437 BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion

The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors...