CVE-2026-118101

The BuddyForms WordPress plugin versions before 2.10.1 is vulnerable to unauthorized post modification. The root cause is a failure to verify that a user editing an existing entry is the original author of the target post. This allows users with low-level permissions, such as Subscriber , who hav...

CVE-2026-118101 BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification

The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form, as low as Subscriber, to overwrite the title, content and status of any other user's posts or pages,...