Improper Access Control in BuddyForms Plugin Affects WordPress Users
CVE-2026-118101
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 30 October 2026
Badges
What is CVE-2026-118101?
The BuddyForms WordPress plugin prior to version 2.10.1 has a significant flaw wherein it fails to ensure that users editing an existing entry are the original authors of the respective post. This oversight permits users with edit permissions, even those at the Subscriber level, to alter the title, content, and status of any post or page authored by others, potentially including posts created by administrators. This vulnerability raises serious concerns around unauthorized access and content integrity within WordPress sites utilizing this plugin.
Affected Version(s)
BuddyForms 0 < 2.10.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.