CVE-2023-7203
Assigner: WPScan
Published: 2024-02-27T08:30:25.017Z
State: PUBLISHED
title: Smart Forms < 2.6.87 - Subscriber+ Arbitrary Entry Deletion
problemTypes: descriptions: description: CWE-862 Missing Authorization
type: CWE
descriptions: description: CWE-352 Cross-Site Request Forgery (CSRF)
type: CWE
affected: vendor: Unknown
product: Smart Forms
versions: status: affected
versionType: semver
version: 0
lessThan: 2.6.87
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
descriptions: value: The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as low as subscriber to call them and perform unauthorised actions such as deleting entries. The plugin also lacks CSRF checks in some places which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as deleting entries.
credits: value: Mohammad Reza Omrani
type: finder
value: WPScan
type: coordinator
source: discovery: EXTERNAL
x_generator: engine: WPScan CVE Generator