BuddyForms CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

LOW BuddyForms CVE published 2026-10-31

CVE-2026-118437

CVE-2026-118437 is a low-severity vulnerability in the BuddyForms WordPress plugin before version 2.10.1. The plugin does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors. This vulnerability affects WordPress installations using the BuddyForms plugin. Defenders should as [truncated]