PT-2026-8088 · WordPress · Smart Forms

Lukasz Sobanski · Publicado 2026-02-14 · Atualizado 2026-02-14 · CVE-2026-2022

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Smart Forms plugin for WordPress versions prior to 2.7.0

Description The Smart Forms plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check on the 'rednao smart forms get campaigns' AJAX action. Attackers with Subscriber-level access or higher can retrieve donation campaign data, including campaign IDs and names. The affected API endpoint is rednao smart forms get campaigns.

Recommendations Update the Smart Forms plugin to version 2.7.0 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-2022

Produtos afetados

Smart Forms

Referências · 7

• https://t.me/CVEtracker/44712 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2022567907574845620 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/smart-forms/trunk/smartforms.php#L90 · Nota
• https://twitter.com/VulmonFeeds/status/2022647936027374016 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/381ec109-ca51-4011-b7e0-aec636540d59?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/smart-forms/trunk/integration/smart-donations-integration-ajax.php#L3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-2022 · Nota de Segurança