BuddyForms versions up to 2.9.0 contain an unauthenticated broken access control flaw that permits an attacker to perform privileged actions normally reserved for authenticated users. This vulnerability can be used to read or modify sensitive data, change plugin settings, or potentially execute arbitrary code if the plugin processes unvalidated input. The impact is limited to the scope of the BuddyForms plugin and the WordPress instance in which it resides, but the lack of authentication makes the risk high for any publicly accessible site.

The vulnerability affects all installations of the Themekraft BuddyForms plugin through version 2.9.0. Systems running any of these affected versions on a WordPress platform are at risk. No, so all WordPress sites that employ the vulnerable BuddyForms plugin are impacted.

The CVSS score of 6.5 reflects a moderate severity, and the EPSS score is not available, making it difficult to gauge real‑world exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is unauthenticated, any user with network access to the WordPress installation can potentially exploit it. The attack vector is inferred to be through HTTP requests targeting the plugin’s endpoints, and the use of standard WordPress authentication controls is bypassed.