Live › vulnerability › CVE-2026-118437
The BuddyForms WordPress plugin before 2.10.1 does not check who owns guest-uploaded attachments before deleting them. An unauthenticated attacker can permanently delete media files uploaded by other anonymous visitors.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 06:33 UTC. All times on this page are UTC.
Sites running the BuddyForms WordPress plugin before 2.10.1 that accept guest uploads through forms. The sources do not say whether the attack needs a particular form setting, so sites without guest uploads may be unaffected; unknown for the rest.
No product ranges from the sources yet.
wp-content/plugins/buddyforms/buddyforms.php2.10.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.
This page as .md · .json · in your agent: get_signal("CVE-2026-118437")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.