{
 "id": "WPSEC-2026-0585",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0585/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0585/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0585/index.md",
 "title": "Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.10.3 - Unauthenticated Missing Authorization to Arbitrary Taxonomy Term Disclosure via bf_load_taxonomy AJAX Action",
 "description": "The BuddyForms plugin for WordPress is vulnerable to unauthorized data access via the bf_load_taxonomy AJAX action in all versions up to, and including, 2.10.3. This is due to the action being available to unauthenticated users, protected only by a nonce printed on pages that show a form with an AJAX-loaded taxonomy field, and building its term query from request values instead of the form's field settings. This makes it possible for unauthenticated attackers to list the IDs and names of terms in any registered taxonomy.",
 "plugin": {
  "slug": "buddyforms",
  "name": "Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms",
  "full_name": "BuddyForms",
  "wordpress_org": "https://wordpress.org/plugins/buddyforms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/buddyforms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/buddyforms"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.10.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.10.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.10.4",
 "remediation": "Update to 2.10.4 or later.",
 "fix_released": "2026-10-06T15:59:50+00:00",
 "published": "2026-10-07T19:47:10+00:00",
 "updated": "2026-10-07T18:51:24.543873+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0585/",
  "https://plugins.svn.wordpress.org/buddyforms/tags/2.10.4/",
  "https://wordpress.org/plugins/buddyforms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/buddyforms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-07"
 }
}