Unauthorized Media File Deletion Vulnerability in The Post Form Plugin

CVE-2024-1170

Summary

The BuddyForms plugin for WordPress, specifically its Frontend Content Forms feature designed for user-generated content submissions, is exposed to unauthorized media file deletion. This vulnerability arises from an inadequate capability check on the handle_deleted_media function, allowing unauthenticated attackers to delete arbitrary media files without authorization. This issue affects all versions of the plugin up to and including version 2.8.7, presenting significant risks for sites utilizing this plugin. Website owners are advised to update to the latest version and review their security posture to mitigate potential exploitation.

References