---
id: CVE-2026-118100
title: BuddyForms < 2.10.3 - Unauthenticated Form Configuration Disclosure
summary: >-
  The BuddyForms WordPress plugin before 2.10.3 does not check that the
  requester is allowed to manage a form before exporting its configuration,
  allowing unauthenticated users to download any form's stored settings,
  including notification…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-200
product: BuddyForms
affected:
  - BuddyForms < 2.10.3
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-30T13:16:41.629915Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T13:26:46.692Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118100'
references:
  - url: 'https://wpscan.com/vulnerability/748ac082-c2cf-4fbf-b41f-363dc881a30e/'
tags:
  - cve.org
epss: 0.00206
epssPercentile: 0.10752
ingestedAt: '2026-11-05T16:07:30.260Z'
---

## Overview

The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configuration, allowing unauthenticated users to download any form's stored settings, including notification recipient email addresses and reCAPTCHA secret keys that are not shown on the public form.

## Affected

- `BuddyForms < 2.10.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.