CVE-2022-0163: Smart Forms < 2.6.71 - Subscriber+ Form Data Download
Published Mar 7, 2022
·Updated
The Smart Forms WordPress plugin before 2.6.71 does not have authorisation in its rednaosmartformsentrieslist AJAX action, allowing any authenticated users, such as subscriber, to download arbitrary form's data, which could include sensitive information such as PII depending on the form.
Affected Software
1 affected component
RedNao Smart Forms WordPress<2.6.71
Event History
Mar 7, 2022
CVE Published
via MITRE·08:16 AM
Data Sourced
via MITRE·08:16 AM
DescriptionWeakness
Frequently Asked Questions
1
What is CVE-2022-0163?
CVE-2022-0163 is a vulnerability in the Smart Forms WordPress plugin before version 2.6.71.
2
What is the severity of CVE-2022-0163?
The severity of CVE-2022-0163 is medium, with a severity value of 6.5.
3
How does CVE-2022-0163 affect Rednao Smart Forms?
CVE-2022-0163 affects Rednao Smart Forms plugin before version 2.6.71.
4
What is the impact of CVE-2022-0163?
CVE-2022-0163 allows authenticated users, such as subscribers, to download arbitrary form's data, including potentially sensitive information.
5
How can I fix CVE-2022-0163 in my Smart Forms WordPress plugin?
To fix CVE-2022-0163, update the Smart Forms plugin to version 2.6.71 or above.