WordPress Plugin Vulnerabilities

Smart Forms < 2.6.92 - Missing Authorization to Notice Dismissal

Description

The Smart Forms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rednao_smart_forms_dont_show_again() function in versions up to, and including, 2.6.91. This makes it possible for authenticated attackers, with subscriber-level access and above, to dismiss notices.

Affects Plugins

Plugin icon
smart-forms
Fixed in 2.6.92

References

CVE
CVE-2024-33593
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/8a643fa1-afdb-4710-ba1c-3b226b4098bd

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Dhabaleshwar Das
Verified
No
WPVDB ID
2c8afa1f-ddf6-4f5b-b3fe-f759e8c68263

Timeline

Publicly Published
2024-04-25 (about 2 years ago)
Added
2024-05-01 (about 2 years ago)
Last Updated
2024-05-01 (about 2 years ago)

Other

Published
Title
Published
2024-01-31
Title
NEX-Forms – Ultimate Form Builder – Contact forms and much more < 8.5.7 - Missing Authorization via set_starred()
Published
2023-12-27
Title
WooCommerce Product Vendors < 2.2.2 - Missing Authorization
Published
2024-11-21
Title
Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) < 2.6.2 - Cross-Site Request Forgery to Limited Arbitrary Options Update
Published
2026-04-20
Title
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress < 4.1133 - Missing Authorization
Published
2025-06-04
Title
HyperComments <= 1.2.2 - Unauthenticated (Subscriber+) Arbitrary Options Update