CVE-2026-118101: BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification
The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form, as low as Subscriber, to overwrite the title, content and status of any other user's posts or pages, including those of administrators.
Event History
Frequently Asked Questions
Which users could exploit this issue?
Any user granted edit access to a BuddyForms form could exploit it, including users with the Subscriber role. The issue affects editing of existing entries through the vulnerable plugin.
What content could an attacker change?
An eligible attacker could overwrite the title, content, and status of posts or pages belonging to other users. This includes posts or pages owned by administrators.
Does exploitation require authentication or user interaction?
Exploitation requires a low-privileged authenticated user account with edit access to a form. No separate user interaction is required.