2026-10-31

CVE-2026-118437 Oct 31, 06:16 LOW PATCH Monitor

WordPress sites running the BuddyForms plugin versions 2.8.8 through 2.10.0 let unauthenticated visitors permanently delete media files that other guest visitors uploaded, because the plugin does not verify ownership of an attachment before acting on a deletion request. The assessed impact is limited to integrity of guest-submitted media (CVSS 3.1 base score 3.7, AV:N/AC:H/PR:N/UI:N/C:N/I:L/A:N) - there is no confidentiality impact and no path to account takeover; only sites that expose forms allowing guest media uploads are exposed. Exploitation status is low-risk across all signals: no public exploit identified at time of analysis, no CISA KEV listing, SSVC exploitation 'none', EPSS 0.16% (5th percentile), and a vendor patch is available in 2.10.1.