CVE-2023-7203

The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as low as subscriber to call them and perform unauthorised actions such as deleting entries. The plugin also lacks CSRF checks in some places which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as deleting entries.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://wpscan.com/vulnerability/b514b631-c3e3-4793-ab5d-35ed0c38b011/	Exploit Third Party Advisory
https://wpscan.com/vulnerability/b514b631-c3e3-4793-ab5d-35ed0c38b011/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:rednao:smart_forms:*:*:*:*:*:wordpress:*:*

History

08 Apr 2025, 19:43

Type	Values Removed	Values Added
CPE		cpe:2.3:a:rednao:smart_forms::::::wordpress::*
References	~~() https://wpscan.com/vulnerability/b514b631-c3e3-4793-ab5d-35ed0c38b011/ -~~	() https://wpscan.com/vulnerability/b514b631-c3e3-4793-ab5d-35ed0c38b011/ - Exploit, Third Party Advisory
First Time		Rednao smart Forms Rednao

Information

Published : 2024-02-27 09:15

Updated : 2025-04-08 19:43

NVD link : CVE-2023-7203

Mitre link : CVE-2023-7203

CVE.ORG link : CVE-2023-7203

JSON object : View

Products Affected

rednao

smart_forms

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2023-7203", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2024-02-27T09:15:37.450", "references": [{"url": "https://wpscan.com/vulnerability/b514b631-c3e3-4793-ab5d-35ed0c38b011/", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/b514b631-c3e3-4793-ab5d-35ed0c38b011/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as low as subscriber to call them and perform unauthorised actions such as deleting entries. The plugin also lacks CSRF checks in some places which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as deleting entries."}, {"lang": "es", "value": "El complemento Smart Forms de WordPress anterior a 2.6.87 no tiene autorizaci\u00f3n en varias acciones AJAX, lo que podr\u00eda permitir a usuarios con un rol tan bajo como suscriptor llamarlos y realizar acciones no autorizadas, como eliminar entradas. El complemento tambi\u00e9n carece de comprobaciones CSRF en algunos lugares, lo que podr\u00eda permitir a los atacantes hacer que los usuarios que han iniciado sesi\u00f3n realicen acciones no deseadas a trav\u00e9s de ataques CSRF, como eliminar entradas."}], "lastModified": "2025-04-08T19:43:37.427", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rednao:smart_forms:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "1A3AAB05-4B07-4621-94A0-4CEF7A0C7ADF", "versionEndExcluding": "2.6.87"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}