{"id":"CVE-2026-118100","kind":"vulnerability","aliases":["CVE-2026-118100"],"related":[],"title":"BuddyForms WordPress plugin: unauthenticated users can export form settings and secrets","description":"The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configuration, allowing unauthenticated users to download any form's stored settings, including notification recipient email addresses and reCAPTCHA secret keys that are not shown on the public form.","summary":"The BuddyForms WordPress plugin before 2.10.3 does not check permissions before exporting a form's configuration. An unauthenticated visitor can download stored settings, including notification recipient emails and reCAPTCHA secret keys.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["buddyforms","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-2.10.3-or-later"],"how_to_check":"- Check the installed BuddyForms version in the WordPress plugins screen or the plugin header in `wp-content/plugins/buddyforms/buddyforms.php`","fix":"- BuddyForms: upgrade to `2.10.3` or later","status":"open","published_at":"2026-10-30T06:16:46+00:00","first_seen_at":"2026-10-30T06:28:39+00:00","triaged_at":"2026-10-30T06:30:00+00:00","updated_at":"2026-10-30T06:30:00+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T06:30:00Z","model":"claude-haiku-5-5","output":{"fix":"- BuddyForms: upgrade to `2.10.3` or later","reach":"internet","title":"BuddyForms WordPress plugin: unauthenticated users can export form settings and secrets","impact":"medium","summary":"The BuddyForms WordPress plugin before 2.10.3 does not check permissions before exporting a form's configuration. An unauthenticated visitor can download stored settings, including notification recipient emails and reCAPTCHA secret keys.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","buddyforms","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attackers read form notification emails and reCAPTCHA secret keys","analyst_note":"Confirm the affected export action or endpoint and whether a WordPress.org advisory gives more detail: https://nvd.nist.gov/vuln/detail/CVE-2026-118100","how_to_check":"- Check the installed BuddyForms version in the WordPress plugins screen or the plugin header in `wp-content/plugins/buddyforms/buddyforms.php`\n- unknown whether the sources list a specific export endpoint to test","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-2.10.3-or-later"],"who_is_affected":"Sites running the BuddyForms plugin before 2.10.3 are exposed to unauthenticated export of form settings. The sources do not describe any extra configuration needed to trigger it. Sites without BuddyForms can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000705,"input_tokens":4120,"output_tokens":585,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118100':14A,17A '-2026':13A,16A '2.10.3':29B,60C 'address':91C 'allow':68C,77C 'buddyform':1A,18B,25B,56C 'check':32B,63C 'configur':39B,76C 'cve':12A,15A 'download':44B,81C 'email':50B,90C 'export':7A,35B,74C 'form':8A,37B,72C,83C,103C 'host':22B 'includ':47B,87C 'key':54B,95C 'manag':70C 'notif':48B,88C 'packag':19B 'permiss':33B 'plugin':3A,27B,58C 'public':102C 'recaptcha':52B,93C 'recipi':49B,89C 'request':66C 'secret':11A,53B,94C 'self':21B 'self-host':20B 'set':9A,46B,86C 'shown':99C 'store':45B,85C 'unauthent':4A,41B,78C 'user':5A,79C 'visitor':42B 'wordpress':2A,23B,26B,57C","nicknames":[],"mitigations":[],"who_affected":"Sites running the BuddyForms plugin before 2.10.3 are exposed to unauthenticated export of form settings. The sources do not describe any extra configuration needed to trigger it. Sites without BuddyForms can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T06:16:46+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118100","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118100","severity":null,"published_at":"2026-10-30T06:16:46+00:00","modified_at":"2026-10-30T06:16:46+00:00","first_seen_at":"2026-10-30T06:28:39+00:00","fetched_at":"2026-10-30T06:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}