BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form, as low as Subscriber, to overwrite the title, content and status of any other user's posts or pages, including those of administrators.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• wpscan.com/…erability/ec14432b-e848-4c10-95a6-8eeba8bf7587 İstismar kodu ya da analiz

Kayıt geçmişi

1. 30 Eki 2026 16:40CVSS puanı değişti: – → 5.3
2. 30 Eki 2026 09:00Yayımlandı

İlgili açıklar

• 3,7 CVE-2026-118437BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion
• 5,3 CVE-2026-118100BuddyForms < 2.10.3 - Unauthenticated Form Configuration Disclosure
• 6,3 CVE-2026-82705Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component
• 6,9 CVE-2026-82704Apache Wicket: A listener is invoked on a page instance the request itself created and never configured
• 2,3 CVE-2026-82558Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke
• 6,9 CVE-2026-82557Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission