CVE-2026-118437

LowCVSS 3.7/10Last modified Nov 2, 2026

Description

The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-73

Affected software

VendorProductVersions
UnknownBuddyForms>= 2.8.8, < 2.10.1

References

Timeline

Published
Oct 31, 2026
Last modified
Nov 2, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1184386.8The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser,CVE-2026-1184394.1The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a useCVE-2026-118444.9The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a Arbitrary File Read vulnerability, allowing privileged remCVE-2026-1184444.8Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nCVE-2026-1184456.9A use-after-free vulnerability in the pybddisasm Python bindings affects structure-valued members of INSTRUX objects. These members are expoCVE-2026-1184466.9A use-after-free vulnerability in the pybddisasm Python bindings affects array-valued members of INSTRUX objects, including ND_OPERAND arrayCVE-2026-1184474.8A use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when instruction decoding fails. TCVE-2026-1184486.9A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, iCVE-2026-118457.2The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a OS Command Injection vulnerability, allowing privileged reCVE-2026-1184505.9Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create filesCVE-2026-1184588.1The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixCVE-2026-1184596.3A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate creden
CVE-2026-118437: Low severity, CVSS 3.7 | Vulnix