CVE-2024-1169 is a High severity missing authorization flaw, scored 7.5, in the Post Form plugin for WordPress, known as BuddyForms. Versions up to and including 2.8.7 are affected. Unauthenticated attackers can upload media files. Update to a release after 2.8.7.
What's affected
The record lists the plugin up to and including 2.8.7. The buddyforms_upload_handle_dropped_media function lacks a capability check, so unauthenticated visitors can upload media files. A related flaw in the same release, CVE-2024-1170, allows deletion of media files.
No fixed version is named. A plugin changeset (3046092) is among the references, but the Wordfence page body could not be read when fetched, so confirm the version in the changelog.
How to check if you're exposed
In the WordPress admin, open Plugins, Installed Plugins and read the version shown under Post Form. From a shell with WP-CLI, list plugins and their versions.
wp plugin list --fields=name,status,version,update
Compare the version with the affected range above. If the plugin is not installed, you are not exposed through this CVE. The free in-browser dependency scan also covers dependencies in your own code, though WordPress plugins are tracked by the site, not a lockfile.
What to do now
- Check the installed plugin version.
- Update to a release after 2.8.7. Patch for CVE-2024-1170 at the same time.
- Review the media library for uploads you do not recognise and remove them.
- Check that upload limits and allowed file types on the server are tight.
- Plan storage and moderation if you accept public submissions.
Why it matters
The class is missing authorization, CWE-862. Upload handlers on public forms must check the caller and the file type. Here the capability check was missing, so any visitor could add files to the site's media library.
The record describes media files, not code, so the main concerns are abuse of your storage and hosting of unwanted content under your domain. The KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this the same as CVE-2024-1170?
No. Both are in BuddyForms 2.8.7 and earlier, but this one allows uploads and CVE-2024-1170 allows deletion.
Is login required?
No. The record says unauthenticated attackers can upload media files.
Sources
- Wordfence advisory (Wordfence advisory, page body could not be read when fetched)
- NVD record and references for CVE-2024-1169
Last reviewed: 19 October 2026.
