Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Smart Forms 2.6.94 Clear all filters
TI-2024-01217 CVE-2024-1307 · GHSA-8j2w-2cpm-xpmr

Smart Forms < 2.6.94 - Subscriber+ Edit Entries via Broken Access Control

Priority MEDIUM 62

The Smart Forms WordPress plugin before 2.6.94 does not have proper authorization in some actions, which could allow users with a role as low as a subscriber to call them and perform unauthorized actions

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00534 Published 2024-04-15 Fixed in 2.6.94 CWE-863
TI-2024-01216 CVE-2024-1306 · GHSA-p29c-5vv5-vh3p

Smart Forms < 2.6.94 - Edit Entries via CSRF

Priority MEDIUM 58

The Smart Forms WordPress plugin before 2.6.94 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as editing entries, and we cons…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00226 Published 2024-04-15 Fixed in 2.6.94 CWE-352