WordPress Plugin Vulnerabilities

BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion

Description

The plugin does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.

Proof of Concept

Affects Plugins

Plugin icon
buddyforms
Fixed in 2.10.1

References

CVE
CVE-2026-118437

Classification

Type
FILE DELETION
OWASP top 10
A6: Security Misconfiguration
CWE
CWE-73
CVSS
3.7 (low)

Miscellaneous

Original Researcher
Muni Nitish Kumar Yaddala
Submitter
Muni Nitish Kumar Yaddala
Verified
Yes
WPVDB ID
20a483cf-7003-4d5a-9abb-afcc3f985ee4

Timeline

Publicly Published
2026-10-29 (about 2 days ago)
Added
2026-10-29 (about 1 day ago)
Last Updated
2026-10-29 (about 1 day ago)

Other

Published
Title
Published
2025-08-22
Title
Wptobe-memberships <= 3.4.2 - Authenticated (Subscriber+) Arbitrary File Deletion
Published
2026-07-02
Title
TinyPNG < 3.6.14 - Author+ Arbitrary File Deletion via convert.path in tiny_compress_images Post Meta
Published
2025-06-27
Title
BeeTeam368 Extensions < 2.3.5 - Subscriber+ Arbitrary File Deletion via Path Traversal
Published
2026-10-29
Title
Forminator Forms < 1.55.1 - Unauthenticated Limited File Deletion via Draft Upload Metadata
Published
2026-07-06
Title
AMP for WP < 1.1.13 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font Upload