What is GHSA-87rp-9h85-83hj?

GHSA-87rp-9h85-83hj is a security advisory published by GitHub Security Advisories with Medium severity. The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to...

Which CVE IDs does GHSA-87rp-9h85-83hj cover?

GHSA-87rp-9h85-83hj covers the following CVE IDs: CVE-2026-118100. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-87rp-9h85-83hj?

GHSA-87rp-9h85-83hj has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-87rp-9h85-83hjMediumCVSS 5.3

The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to...

Vendor

GitHub Security Advisories

Published

October 30, 2026

Last Modified

October 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-118100 →

📋 Description

The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configuration, allowing unauthenticated users to download any form's stored settings, including notification recipient email addresses and reCAPTCHA secret keys that are not shown on the public form.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-118100
https://wpscan.com/vulnerability/748ac082-c2cf-4fbf-b41f-363dc881a30e
https://github.com/advisories/GHSA-87rp-9h85-83hj