PT-2026-8088 · WordPress · Smart Forms

Lukasz Sobanski · Published 2026-02-14 · Updated 2026-02-14 · CVE-2026-2022

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Smart Forms plugin for WordPress versions prior to 2.7.0

Description The Smart Forms plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check on the 'rednao smart forms get campaigns' AJAX action. Attackers with Subscriber-level access or higher can retrieve donation campaign data, including campaign IDs and names. The affected API endpoint is rednao smart forms get campaigns.

Recommendations Update the Smart Forms plugin to version 2.7.0 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-2022

Affected Products

Smart Forms

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-2022 · Security Note
• https://t.me/CVEtracker/44712 · Telegram Post
• https://twitter.com/CVEnew/status/2022567907574845620 · Twitter Post
• https://plugins.trac.wordpress.org/browser/smart-forms/trunk/smartforms.php#L90 · Note
• https://twitter.com/VulmonFeeds/status/2022647936027374016 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/381ec109-ca51-4011-b7e0-aec636540d59?source=cve · Note
• https://plugins.trac.wordpress.org/browser/smart-forms/trunk/integration/smart-donations-integration-ajax.php#L3 · Note