PT-2022-13004 · WordPress · Smart Forms

Krzysztof Zając · Published 2022-03-07 · Updated 2022-03-11 · CVE-2022-0163

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Smart Forms WordPress plugin versions prior to 2.6.71

Description The issue allows any authenticated user to download arbitrary form data due to a lack of authorization in the rednao smart forms entries list AJAX action. This could potentially expose sensitive information, including personally identifiable information (PII), depending on the form's content.

Recommendations For versions prior to 2.6.71, update to version 2.6.71 or later to resolve the issue.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-0163

Affected Products

Smart Forms

References · 3

• 🔥 https://wpscan.com/vulnerability/2b6b0731-4515-498a-82bd-d416f5885268 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-0163 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0163 · Vendor Advisory