CVE-2026-81785: WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerability
Published Sep 10, 2026
·Updated
Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions.
Affected Software
1 affected component
WordPress BuddyForms<=2.9.0
Event History
Sep 10, 2026
CVE Published
via MITRE·02:23 PM
Data Sourced
via MITRE·02:23 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The issue is described as unauthenticated, so an attacker does not need a WordPress account or prior privileges to exploit the affected access-control weakness.
2
Which installations are affected?
BuddyForms versions 2.9.0 and earlier are affected. The provided information does not state whether any particular BuddyForms configuration or WordPress setup is required.
3
What is the likely impact?
The supplied severity vector indicates low integrity and availability impact, with no confidentiality impact. The issue can be exploited remotely with low attack complexity and requires no user interaction.