Smart Forms – when you need more than just a contact form, CVE-2022-0163

CVE, Research URL: CVE-2022-0163
Home page URL: Security reports for Smart Forms – when you need more than just a contact form
Application: Smart Forms – when you need more than just a contact form
Published on: Mar 07, 2022
Research Description: The Smart Forms WordPress plugin before 2.6.71 does not have authorisation in its rednao_smart_forms_entries_list AJAX action, allowing any authenticated users, such as subscriber, to download arbitrary form's data, which could include sensitive information such as PII depending on the form.
Affected versions: max 2.6.71.
Status: vulnerable

Smart Forms &#8211; when you need more than just a contact form, CVE-2022-0163