PT-2026-134429

CVE-2026-118437

·

Published

2026-10-31

·

Updated

2026-10-31

Description by

CVSS 3.1
3.7
Low
MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.
Exploitability
Exploit
Fix
Vendors
Affected products
Weakness enumeration
CWE-73: External Control of File Name or Path
Related identifiers
CVE-2026-118437
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com