CVE-2024-1307 Smart Forms < 2.6.94 - Subscriber+ Edit Entries via Broken Access Control

2024-04-1505:00:03

WPScan

github.com

cve-2024-1307

smart forms

unauthorized access

AI Score

6.7

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

The Smart Forms WordPress plugin before 2.6.94 does not have proper authorization in some actions, which could allow users with a role as low as a subscriber to call them and perform unauthorized actions

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:rednao:smart_forms:*:*:*:*:*:wordpress:*:*"
    ],
    "vendor": "rednao",
    "product": "smart_forms",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.6.94",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]