anonhaven

CVE-2026-118437

NONE EPSS 0.16%
Updated Oct 31, 2026
Unknown
Parameter Value
Affected Versions before 2.10.1
Type CWE-73 External Control of File Name or Path
Vendor Unknown
Public PoC No

The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.

Weakness Type (CWE)

CWE-73 External Control of File Name or Path

Vulnerable Products

unknown:buddyforms

References 1

https://wpscan.com/vulnerability/20a483cf-7003-4d5a-9abb-afcc3f985ee4/
contact@wpscan.com
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-94361

Unknown

None

CVE-2026-82214

Unknown

None

CVE-2026-118638

Unknown

None

CVE-2026-118629

Unknown

None

CVE-2026-118438

Unknown

None