CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Smart Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'rednao_smart_forms_get_campaigns' AJAX action in all versions up to, and including, 2.6.99. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve donation campaign data including campaign IDs and names.
Explanation of Vulnerability in Simple Terms
Smart Forms contains an authorization flaw that allows authenticated users to access sensitive information they should not be able to view. An attacker with a low-privilege account can read data belonging to other users or the site without additional interaction. The vulnerability affects all versions up to 2.6.99. Update to a version newer than 2.6.99 to remediate.
What an attacker can do
Read sensitive data or information belonging to other users or the site.
Potential impact on your site
User data and site information may be exposed to authenticated attackers with limited permissions.
Conditions required to exploit
Attacker must have a low-privilege account on the site; no user interaction required.
Key dates
External resources
