Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.10.3 - Authenticated (Contributor+) Path Traversal to Local File Inclusion via List Submissions Block
- ID
- WPSEC-2026-0586
- Plugin
- BuddyForms (buddyforms)
- Affected
- all versions before 2.10.4
- Remediation
- Update to 2.10.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-22
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-07
- Attack surface
- Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms on WPSec AttackSurface
- Fix released
- Published
Description
The BuddyForms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.10.3 via the 'bf_list_posts_style' attribute of the List Submissions block. The attribute value was used without validation as a template name, placed between the plugin's templates directory and a fixed '.php' suffix, and the resulting path was included. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute .php files on the server, which can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php files can be uploaded and included.
References
- https://wpsec.com/vuln/WPSEC-2026-0586/
- https://plugins.svn.wordpress.org/buddyforms/tags/2.10.4/
- https://wordpress.org/plugins/buddyforms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS