{
 "id": "WPSEC-2026-0581",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0581/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0581/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0581/index.md",
 "title": "Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.10.0 - Unauthenticated Missing Authorization to Limited Attachment Deletion",
 "description": "The BuddyForms plugin for WordPress is vulnerable to unauthorized attachment deletion via the handle_deleted_media AJAX action in all versions up to, and including, 2.10.0. This is due to an insufficient ownership check that compared the attachment's author with the current user ID, which is 0 for every logged-out visitor. This makes it possible for unauthenticated attackers to delete attachments that have no author, such as files uploaded by logged-out visitors through public forms.",
 "plugin": {
  "slug": "buddyforms",
  "name": "Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms",
  "full_name": "BuddyForms",
  "wordpress_org": "https://wordpress.org/plugins/buddyforms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/buddyforms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/buddyforms"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.10.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.10.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.10.1",
 "remediation": "Update to 2.10.1 or later.",
 "fix_released": "2026-10-03T21:02:24+00:00",
 "published": "2026-10-07T19:47:10+00:00",
 "updated": "2026-10-07T18:51:22.064072+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0581/",
  "https://plugins.svn.wordpress.org/buddyforms/tags/2.10.1/",
  "https://wordpress.org/plugins/buddyforms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/buddyforms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-07"
 }
}