CVE-2026-118101

MediumCVSS 5.3/10Last modified Oct 30, 2026

Description

The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form, as low as Subscriber, to overwrite the title, content and status of any other user's posts or pages, including those of administrators.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
UnknownBuddyForms< 2.10.1

References

Timeline

Published
Oct 30, 2026
Last modified
Oct 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1181025.9Use of a broken or risky cryptographic algorithm in SQL Server allows an unauthorized attacker to disclose information over a network.CVE-2026-1181036.5Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over a network.CVE-2026-1181046.5Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-1181058.8Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate CVE-2026-1181068.1Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.CVE-2026-1181087.5Improper authorization in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-1181098.8Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate CVE-2026-118113.7The UpdateHub over-the-air update client's start_coap_client() in subsys/mgmt/updatehub/updatehub.c leaks the CoAP/DTLS socket descriptor onCVE-2026-1181108.8Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate CVE-2026-1181118.0Origin validation error in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-1181128.0Improper control of generation of code ('code injection') in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-1181138.0Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate
CVE-2026-118101: Medium severity, CVSS 5.3 | Vulnix