CVE-2026-118100
Received Received - Intake

BuddyForms Form Configuration Exposure Vulnerability

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: WPScan

Description
The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configuration, allowing unauthenticated users to download any form's stored settings, including notification recipient email addresses and reCAPTCHA secret keys that are not shown on the public form.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-118100
EUVD
EUVD-2026-113730

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown BuddyForms 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The BuddyForms WordPress plugin before version 2.10.3 has a vulnerability where it does not verify if a user is authorized to manage a form before allowing them to export its configuration. This lets unauthenticated users download any form's settings, including sensitive data like email addresses for notifications and reCAPTCHA secret keys that are not visible on the public form.

Detection Guidance

Check if your BuddyForms plugin version is below 2.10.3. Use WordPress admin panel or run: wp plugin list | grep buddyforms. If outdated, update immediately.

Impact Analysis

This vulnerability could allow attackers to access sensitive information such as email addresses used for form notifications and reCAPTCHA secret keys. This may lead to spam, phishing attempts, or unauthorized access to protected resources if the exposed data is misused.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR if personal data like email addresses is exposed without authorization. For HIPAA, if the plugin handles protected health information, unauthorized access could violate confidentiality requirements.

Mitigation Strategies

Update the BuddyForms plugin to version 2.10.3 or later. If immediate update is not possible, disable the plugin temporarily until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118100. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart