CVE-2025-62973
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
BuddyForms (Themekraft plugin) up to version 2.10.2 contains a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. Attackers can exploit this for unauthorized operations.
Risk Assessment
The risk includes unauthorized access to administrative functions or sensitive data, potentially leading to system integrity compromise.
Recommendation
Update BuddyForms to a version above 2.10.2 if a fix is available. Restrict access to the plugin and regularly review permissions.
Other vulnerabilities in BuddyForms
See all- CVE-2026-81785Medium
The BuddyForms plugin in versions up to and including 2.9.0 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. Missing proper access control allows operations that a user should not be permitted to perform.
- CVE-2025-32151High
The BuddyForms plugin (up to version 2.10.2) contains a PHP Local File Inclusion vulnerability due to improper control of filename for include/require statement.
Original NVD description (English source)
Missing Authorization vulnerability in Themekraft BuddyForms buddyforms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BuddyForms: from n/a through 2.10.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS