BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Arbitrary Guest Attachment Deletion

The BuddyForms plugin for WordPress is vulnerable to Improper Authorization in versions 2.8.8 through 2.10.0. This is due to missing check for an empty current user ID before comparing post_author to the requesting user, causing all unauthenticated users to share user ID 0 and match any guest-uploaded attachment. This makes it possible for unauthenticated attackers to permanently delete media attachments uploaded by other unauthenticated visitors by exploiting the shared guest user ID of 0. A form with public (guest) file upload must be active on the site.

Requests carrying this pattern arrive without a session, so nothing upstream of the firewall gets a chance to reject them: WordSec's web application firewall inspects request payloads before WordPress loads them. Classes like this one can leave something behind, so the staged malware scanner is the second half: it looks for dropped files and modified code rather than for the request that created them. None of that substitutes for the fix: BuddyForms 2.10.1 closes this, and updating the plugin is the step that ends it.

• Firewall
• Scanner
• Login Security