CVE-2024-1170 is a High severity missing authorization flaw, scored 8.2, in the Post Form plugin for WordPress, known as BuddyForms. Versions up to and including 2.8.7 are affected. Unauthenticated attackers can delete arbitrary media files. Update to a release after 2.8.7.
What's affected
The record lists the plugin up to and including 2.8.7. The handle_deleted_media function lacks a capability check, so unauthenticated visitors can delete arbitrary media files. It is paired with CVE-2024-1169, which covers uploads.
The record names no fixed version. A changeset (3046092) is among the references, but the Wordfence page body could not be read when fetched. Confirm the fixed release in the plugin changelog.
How to check if you're exposed
In the WordPress admin, open Plugins, Installed Plugins and read the version shown under Post Form. From a shell with WP-CLI, list plugins and their versions.
wp plugin list --fields=name,status,version,update
Compare the version with the affected range above. If the plugin is not installed, you are not exposed through this CVE. The free in-browser dependency scan also covers dependencies in your own code, though WordPress plugins are tracked by the site, not a lockfile.
What to do now
- Check the installed plugin version.
- Update to a release after 2.8.7, which should also cover CVE-2024-1169.
- Check that you have recent backups of the uploads directory and the database.
- Look for missing images or documents on your site and restore from backup if needed.
- Review server logs for requests to the plugin's delete handler from unknown addresses.
Why it matters
The class is missing authorization, CWE-862. A delete handler that anyone can call lets an outsider remove content, in this case files from the media library. The impact is on integrity and availability: pages with broken images, missing downloads, lost user submissions.
Backups turn this from a bad day into a restore task. The record gives a score of 8.2, and the KEV flag is false.
Quick check
Can deleted files be recovered?
Only from your backups. The plugin flaw lets deletion happen without a login, so keep recent copies of your uploads.
Which version fixes it?
The record names none beyond 'up to 2.8.7'. Use the first newer release and confirm in the changelog.
Sources
- Wordfence advisory (Wordfence advisory, page body could not be read when fetched)
- NVD record and references for CVE-2024-1170
Last reviewed: 19 October 2026.
