---
id: "CVE-2026-118100"
kind: "vulnerability"
aliases: ["CVE-2026-118100"]
title: "BuddyForms WordPress plugin: unauthenticated users can export form settings and secrets"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["buddyforms", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-2.10.3-or-later"]
published_at: "2026-10-30T06:16:46+00:00"
first_seen_at: "2026-10-30T06:28:39+00:00"
updated_at: "2026-10-30T06:30:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118100", "first_seen_at": "2026-10-30T06:28:39+00:00"}]
---

# BuddyForms WordPress plugin: unauthenticated users can export form settings and secrets

The BuddyForms WordPress plugin before 2.10.3 does not check permissions before exporting a form's configuration. An unauthenticated visitor can download stored settings, including notification recipient emails and reCAPTCHA secret keys.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed BuddyForms version in the WordPress plugins screen or the plugin header in `wp-content/plugins/buddyforms/buddyforms.php`

## Fix

- BuddyForms: upgrade to `2.10.3` or later

## Timeline

- 2026-10-30T06:28:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118100

## From the sources

The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configuration, allowing unauthenticated users to download any form's stored settings, including notification recipient email addresses and reCAPTCHA secret keys that are not shown on the public form.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_