CVE-2026-118100: BuddyForms < 2.10.3 - Unauthenticated Form Configuration Disclosure
The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configuration, allowing unauthenticated users to download any form's stored settings, including notification recipient email addresses and reCAPTCHA secret keys that are not shown on the public form.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BuddyFormsto a version that resolves this vulnerability.Fixed in 2.10.3
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote user can exploit it. No account, privileges, or user interaction are required.
What information may be exposed?
An attacker can download stored configuration for any form, including notification recipient email addresses and reCAPTCHA secret keys that are not displayed on the public form.
Which installations are affected?
BuddyForms versions before 2.10.3 are affected. The issue is in the form-configuration export authorization check, so forms with stored settings may be exposed.