# Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.10.3 - Authenticated (Contributor+) Path Traversal to Local File Inclusion via List Submissions Block

- **ID:** WPSEC-2026-0586
- **Plugin:** BuddyForms (`buddyforms`), https://wordpress.org/plugins/buddyforms/
- **Affected versions:** all versions before 2.10.4
- **Fixed in:** 2.10.4 (Update to 2.10.4 or later.)
- **Severity:** High 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-22
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/buddyforms
- **Fix released:** 2026-10-06
- **Published:** 2026-10-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0586/

## Description

The BuddyForms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.10.3 via the 'bf_list_posts_style' attribute of the List Submissions block. The attribute value was used without validation as a template name, placed between the plugin's templates directory and a fixed '.php' suffix, and the resulting path was included. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute .php files on the server, which can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php files can be uploaded and included.

## References

- https://wpsec.com/vuln/WPSEC-2026-0586/
- https://plugins.svn.wordpress.org/buddyforms/tags/2.10.4/
- https://wordpress.org/plugins/buddyforms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0586/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.