Aller au contenu
Se connecter
5.3 Moyenne

CVE-2026-118100 The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before…

Description

The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configuration, allowing unauthenticated users to download any form's stored settings, including notification recipient email addresses and reCAPTCHA secret keys that are not shown on the public form.

Produits et versions touchés

Produit Versions touchées Corrigé en
BuddyForms 2.10 premières → < 2.10.3 2.10.3

Autres CVE de BuddyForms

Les 3 CVE de BuddyForms →
CVE-2026-118437 The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded… 3.7 Faible CVE-2026-118101 The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the… 5.3 Moyenne
Suivre cette CVE