BuddyForms < 2.10.3 - Unauthenticated Form Configuration Disclosure

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configuration, allowing unauthenticated users to download any form's stored settings, including notification recipient email addresses and reCAPTCHA secret keys that are not shown on the public form.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• wpscan.com/…erability/748ac082-c2cf-4fbf-b41f-363dc881a30e İstismar kodu ya da analiz

Kayıt geçmişi

1. 30 Eki 2026 16:40CVSS puanı değişti: – → 5.3
2. 30 Eki 2026 09:00Yayımlandı

İlgili açıklar

• 3,7 CVE-2026-118437BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion
• 5,3 CVE-2026-118101BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification
• 3,3 CVE-2026-120503EchoHS GeekezBrowser Public API status information disclosure
• 5,1 CVE-2026-102801Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.1
• 5,8 CVE-2025-13647Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths
• 6,6 CVE-2026-101178Permission control vulnerability in the autofill service module.