CVE-2026-118437— BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion
Quick assessment
Affected
Unknown BuddyForms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
BuddyForms WordPress 插件在 2.10.1 版本之前，在删除由访客上传的附件前未能正确验证所有权，这使得未认证的攻击者能够永久删除其他未认证访客上传的媒体文件。
Possible ATT&CK Techniques 1 AI
T1485 · Data Destruction
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-118437
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion
Source: CVE Program / CVE List V5
Vulnerability Description
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | BuddyForms | 2.8.8 ~ 2.10.1 | - |
|
II. Public POCs for CVE-2026-118437
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-118437
请登录查看更多情报信息。
Other References for CVE-2026-118437 (1)
-
https://wpscan.com/vulnerability/20a483cf-7003-4d5a-9abb-afcc3f985ee4/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-10-31 · 11 CVEs total
| CVE-2026-94361 | PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned Callback | |
| CVE-2026-118185 | Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Limiting | |
| CVE-2026-118629 | All-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure | |
| CVE-2026-118438 | Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute | |
| CVE-2026-118638 | Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker RE | |
| CVE-2026-82214 | Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure vi | |
| CVE-2026-118184 | Premium Packages < 7.2.2 - Unauthenticated Order Total Manipulation | |
| CVE-2026-118043 | Bulk Media Register < 2.01 - Author+ Arbitrary File Move via Path Traversal | |
| CVE-2026-110808 | Essential Addons for Elementor 6.6.0 - 6.8.7 - Author+ Privilege Escalation via register_u | |
| CVE-2026-110042 | Payment Forms for Paystack < 4.0.6 - Contributor+ Sensitive Information Disclosure via Set |
IV. Related Vulnerabilities
Same product: BuddyForms
-
CVE-2026-118101
BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modificatio -
CVE-2026-118100
BuddyForms < 2.10.3 - Unauthenticated Form Configuration Dis -
CVE-2026-81785
WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control -
CVE-2025-62973
WordPress BuddyForms plugin <= 2.10.2 - Broken Access Contro -
CVE-2025-32151
WordPress BuddyForms plugin <= 2.10.2 - Local File Inclusion
Same vendor: Unknown
-
CVE-2026-94361
PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery -
CVE-2026-118185
Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Lim -
CVE-2026-118629
All-in-One Video Gallery < 5.0.0 - Unauthenticated Private a -
CVE-2026-118438
Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Im -
CVE-2026-118638
Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Mod