CVE-2023-7203

Smart Forms < 2.6.87 - Subscriber+ Arbitrary Entry Deletion

Medium · published February 27, 2024

CVSS v3.1
6.1
EPSS
0%
Percentile
11.5
In the wild
Unconfirmed
What it is

The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as low as subscriber to call them and perform unauthorised actions such as deleting entries. The plugin also lacks CSRF checks in some places which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as deleting entries.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00217 · 11.5th percentile
Published
2024-02-27T08:30Z
EPSS history
Timeline
  • 27 FEB 08:30Z
    Smart Forms < 2.6.87 - Subscriber+ Arbitrary Entry Deletion
    cvelistv5