Live › vulnerability › CVE-2026-118100
The BuddyForms WordPress plugin before 2.10.3 does not check permissions before exporting a form's configuration. An unauthenticated visitor can download stored settings, including notification recipient emails and reCAPTCHA secret keys.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 06:28 UTC. All times on this page are UTC.
Sites running the BuddyForms plugin before 2.10.3 are exposed to unauthenticated export of form settings. The sources do not describe any extra configuration needed to trigger it. Sites without BuddyForms can skip it.
No product ranges from the sources yet.
wp-content/plugins/buddyforms/buddyforms.php2.10.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configuration, allowing unauthenticated users to download any form's stored settings, including notification recipient email addresses and reCAPTCHA secret keys that are not shown on the public form.
This page as .md · .json · in your agent: get_signal("CVE-2026-118100")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.