WordPress Smart Forms plugin <= 2.6.84 - Authenticated Arbitrary Options Change Vulnerability

CVE-2023-49856

Summary

A missing authorization vulnerability exists in RedNao's Smart Forms, which allows attackers to exploit incorrectly configured access control security levels. This vulnerability affects all versions from n/a to 2.6.84. Malicious actors can leverage this flaw to gain unauthorized access, potentially executing actions outside of their intended permissions. Organizations using affected versions of Smart Forms should review their access control configurations and apply necessary updates to mitigate the risk of exploitation.

References