// For flags

CVE-2022-0163

Smart Forms < 2.6.71 - Subscriber+ Form Data Download

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The Smart Forms WordPress plugin before 2.6.71 does not have authorisation in its rednao_smart_forms_entries_list AJAX action, allowing any authenticated users, such as subscriber, to download arbitrary form's data, which could include sensitive information such as PII depending on the form.

El plugin Smart Forms de WordPress versiones anteriores a 2.6.71, no presenta autorización en su acción AJAX rednao_smart_forms_entries_list, permitiendo a cualquier usuario autenticado, como el suscriptor, descargar datos arbitrarios del formulario, que podrían incluir información confidencial como PII dependiendo del formulario

*Credits: Krzysztof Zając
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-01-10 CVE Reserved
  • 2022-02-14 CVE Published
  • 2023-09-28 EPSS Updated
  • 2024-08-02 CVE Updated
  • 2024-08-02 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-862: Missing Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Rednao
Search vendor "Rednao"
 Smart Forms
Search vendor "Rednao" for product "Smart Forms"
 < 2.6.71
Search vendor "Rednao" for product "Smart Forms" and version " < 2.6.71"
wordpress
Affected