Description
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | BuddyForms | 2.8.8 – < 2.10.1 | 2.10.1 |
References
- https://wpscan.com/vulnerability/20a483cf-7003-4d5a-9abb-afcc3f985ee4/ exploit vdb-entry technical-description