Live › vulnerability › CVE-2026-118101
The BuddyForms WordPress plugin before 2.10.1 does not check that a user editing an existing form entry is its author. A user with edit access to a form, as low as Subscriber, can overwrite the title, content and status of any other user's posts or pages, including administrators'.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 06:28 UTC. All times on this page are UTC.
Sites running the BuddyForms plugin before 2.10.1 that let users edit existing form entries. Exposure depends on whether low-privilege roles such as Subscriber have edit access to a form. Sites without BuddyForms, or with it updated to 2.10.1 or later, are not affected.
No product ranges from the sources yet.
2.10.1 are affected.2.10.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form, as low as Subscriber, to overwrite the title, content and status of any other user's posts or pages, including those of administrators.
This page as .md · .json · in your agent: get_signal("CVE-2026-118101")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.