Unauthenticated Broken Access Control in BuddyForms by WordPress
CVE-2026-81785

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Buddyforms
Vendor
CVE Published:
10 September 2026

What is CVE-2026-81785?

The BuddyForms plugin versions up to 2.9.0 for WordPress is susceptible to an unauthenticated Broken Access Control vulnerability. This flaw allows attackers to bypass authorization mechanisms, potentially permitting them to access or manipulate restricted data and functions without appropriate user credentials. It is crucial for users of the affected versions to implement immediate updates or apply necessary patches to mitigate potential exploitation.

Affected Version(s)

BuddyForms <= 2.9.0

References

https://patchstack.com/database/wordpress/plugin/buddyfor...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peng Zhou | Patchstack Bug Bounty Program
.