CVE-2026-118101
BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form, as low as Subscriber, to overwrite the title, content and status of any other user's posts or pages, including those of administrators.
| Vendor | unknown |
| Product | buddyforms |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown buddyforms
Be the first to know when new unknown vulnerabilities affecting unknown buddyforms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / BuddyForms
0 < 2.10.1
References
Credits
Furkan Arslan WPScan