Question 1

What is CVE-2026-118437 — CVE-2026-118437?

Accepted Answer

The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.

Question 2

What is the authoritative source for CVE-2026-118437?

Accepted Answer

CVE-2026-118437 (CVE-2026-118437) is catalogued in NVD + CISA KEV + FIRST EPSS and curated for EU compliance use cases by SQUR.

CVE-2026-118437CVE-2026-118437

Description

Scoring