Smart Forms < 2.6.87 - Subscriber+ Arbitrary Entry Deletion
Priority MEDIUM 60CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-352.
Summary
The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as low as subscriber to call them and perform unauthorised actions such as deleting entries. The plugin also lacks CSRF checks in some places which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as deleting entries.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00217 12th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Smart Forms (Unknown): 2.6.87
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Smart Forms | before 2.6.87 | 2.6.87 | Patch available | CNA |
- Smart Forms VendorUnknown Affected before 2.6.87 Fixed in 2.6.87 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rednao:smart_forms:*:*:*:*:*:wordpress:*:* | before 2.6.87 | Vulnerable | edgarrojas |
- cpe:2.3:a:rednao:smart_forms:*:*:*:*:*:wordpress:*:* Versions before 2.6.87 Vulnerable ·edgarrojas
Remediation
- Fix · CNA Smart Forms (Unknown) Fixed in 2.6.87
Timeline
- 2026-10-02 Threatist record created from CVE-2023-7203
- 2026-10-03 Alias added: GHSA-5q3g-vh9g-mjh9
References
More edgarrojas Smart Forms vulnerabilities
- TI-2024-01217 Smart Forms < 2.6.94 - Subscriber+ Edit Entries via Broken Access Control CVSS 3.1MEDIUM 6.5
- TI-2024-01216 Smart Forms < 2.6.94 - Edit Entries via CSRF CVSS 3.1MEDIUM 5.4
- TI-2019-04220 Cross-site request forgery in edgarrojas Smart Forms CVSS 3.1HIGH 8.8
- TI-2023-27260 WordPress Smart Forms plugin <= 2.6.84 - Authenticated Arbitrary Options Change Vulnerability CVSS 3.1HIGH 8.8
- TI-2022-00104 Smart Forms < 2.6.71 - Subscriber+ Form Data Download CVSS 3.1MEDIUM 6.5
- TI-2024-01773 Smart Forms < 2.6.96 - Admin+ Stored XSS CVSS 3.1MEDIUM 5.9
Sources
- CVE-2023-7203 · CVE Program
- CVE-2023-7203 · NVD
- FIRST EPSS
- GHSA-5q3g-vh9g-mjh9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences