CVE-2026-118437 BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion

The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors...

CVE-2026-118437

The BuddyForms WordPress plugin (versions 2.8.8 through 2.10.0 ) is vulnerable to an unauthenticated guest attachment deletion flaw. The software fails to properly verify ownership before processing the deletion of attachments uploaded by guests. This oversight allows unauthenticated attackers to...