CVE-2026-81785
MediumCVSS 6.5Summary
The BuddyForms plugin in versions up to and including 2.9.0 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. Missing proper access control allows operations that a user should not be permitted to perform.
Risk Assessment
An unauthenticated attacker can bypass access control mechanisms and perform unauthorized actions on the WordPress site. This may lead to data modification or exposure of resources.
Recommendation
Update the BuddyForms plugin to a version newer than 2.9.0 that includes the access control fix. Until then, consider restricting access to the plugin's functionality.
Other vulnerabilities in BuddyForms
See all- CVE-2025-62973Medium
BuddyForms (Themekraft plugin) up to version 2.10.2 contains a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. Attackers can exploit this for unauthorized operations.
- CVE-2025-32151High
The BuddyForms plugin (up to version 2.10.2) contains a PHP Local File Inclusion vulnerability due to improper control of filename for include/require statement.
Original NVD description (English source)
Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS