BuddyForms EUVD-2026-113730

No special conditions beyond the plugin being installed and active - remote unauthenticated exploitation against default configurations of the BuddyForms WordPress plugin before 2.10.3, with no user interaction or authentication required (AV:N/PR:N/UI:N). The meaningfulness of the disclosure is bounded by what the target has configured: the leaked data is only valuable where a form actually stores sensitive settings such as notification recipient email addresses or a reCAPTCHA secret key. Sites running 2.10.3 or later are not affected. There is no required privilege level or non-default mode acting as a limiting factor, which is why the flaw is easily automatable at scale.

This is a genuine but moderate-priority information-disclosure flaw, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity access with no user interaction, matching the description's claim that unauthenticated users can download any form's stored configuration. Impact is capped at C:L/I:N/A:N - read-only exposure of configuration secrets, no write or availability effect. The SSVC framework aligns with a measured response: Exploitation=none (no observed in-the-wild activity), Automatable=yes (the request can be scripted against many sites), Technical Impact=partial. EPSS is low at 0.15% (4th percentile), and there is no CISA KEV listing, so there is no evidence of active or widespread exploitation despite the easy, automatable attack surface. The vuln.today 'this_month' decision label reflects this: worth patching on a normal cycle, not an emergency. The practical risk is elevated above a typical 5.3 because the leaked data - notification recipient email addresses and reCAPTCHA secret keys - can enable follow-on abuse (bypassing reCAPTCHA protection, spam/phishing targeting). Net: a real priority to patch but not a drop-everything issue; the Automatable=yes signal means it could be swept at scale if an exploit is published, so do not let the low EPSS alone defer it.

An unauthenticated attacker sends a crafted request to the BuddyForms export endpoint on a target WordPress site and retrieves a form's full stored configuration without any permission check. The returned settings expose notification recipient email addresses and the site's reCAPTCHA secret key, which the attacker can then use to defeat the form's bot protection or to target the exposed addresses. Exploitation requires no authentication, no user interaction, and low attack complexity (AV:N/AC:L/PR:N/UI:N), making it trivially scriptable, though no confirmed public exploit code is identified in the provided sources.