BuddyForms CVE-2026-118437

Requires the target site to run BuddyForms 2.8.8 through 2.10.0 with a form configured to allow guest (unauthenticated) media uploads, since the flaw concerns guest-uploaded attachments; the attacker must reference attachment identifiers belonging to other unauthenticated visitors. Exploitation is limited to deleting such guest-uploaded media (no confidentiality impact, no account takeover), and the high attack complexity reflects the need to target valid other-visitor attachments rather than a trivially repeatable action against default state. Sites not exposing guest uploads are not affected.

All decision signals align toward low real-world priority. The official CVSS is only 3.7, and its vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) shows a network-reachable, unauthenticated flaw whose impact is limited to a single low-integrity effect (deletion of other guests' media) with no confidentiality or availability impact and high attack complexity. EPSS reinforces this at 0.16% (5th percentile), the vuln.today Decision label is 'monitor', and SSVC records Exploitation: none, Automatable: no, Technical Impact: partial - a fully consistent, non-urgent picture. This is NOT in CISA KEV and no PoC is provided in the input. The signals do not conflict; the only notable discrepancy is metadata, not risk: the 'Information Disclosure' tag contradicts the actual mechanism (unauthorized file deletion = integrity, I:L, C:N), so treat this as a low-severity integrity/data-loss issue rather than a disclosure issue. Overall this is a genuine but low-priority defect - patch during normal maintenance, not an emergency.

On a site running a vulnerable BuddyForms version that permits guest (unauthenticated) media uploads, an attacker sends crafted delete requests referencing attachment identifiers belonging to other anonymous visitors; because ownership is not verified, those media files are permanently removed. No authentication or user interaction is required, but AC:H reflects that the attacker must target valid attachment references, and no public exploit is identified at time of analysis.