BuddyForms CVE-2026-118101

Requires an authenticated account that has been granted edit access to a BuddyForms form - the role can be as low as Subscriber - on a site running BuddyForms before 2.10.1. The attacker must reference the target post or page ID of another user to overwrite its title, content, and status. Limiting factors: exploitation is not possible against a default WordPress install without BuddyForms configured to grant lower-privilege roles edit access to form entries, so the realistic exposure is sites that intentionally allow Subscriber/low-role front-end post editing; no user interaction from the victim is needed and no special client is required beyond that granted access.

This is a medium-severity, authorization flaw (CWE-862) whose signals consistently point to low-to-moderate real-world urgency rather than an emergency. The NVD vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N, 5.3) shows network reach but requires an authenticated low-privilege account (PR:L) and yields integrity-only impact (I:H; no confidentiality or availability loss). EPSS is 0.13% (3rd percentile) - very low exploitation probability - and SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial, all of which agree with the vuln.today 'this_month' priority rather than an immediate-action label. There is no CISA KEV listing and no confirmed public exploit code. One inconsistency: the NVD vector marks AC:H, but the description gives no trigger complexity (no race, timing, or attacker-uncontrolled condition is stated) - overwriting another user's post once form-edit access is held appears straightforward, so AC:H is not substantiated by the available evidence and is assessed here as AC:L. Net: a legitimate but non-emergency fix-this-cycle issue, not a high-CVSS-but-illusory risk nor a critical incident.

An attacker holding a low-privilege account (as low as Subscriber) that has been granted edit access to a BuddyForms form submits an edit request referencing another user's post or page ID; because the plugin never verifies the editor is the post author, the attacker overwrites that post's title, content, and status - for example defacing or unpublishing an administrator's page. Exploitation is over the network but requires that authenticated form-edit access (PR:L). No public exploit code is identified at time of analysis.