CVE-2023-7203 Smart Forms < 2.6.87 - Subscriber+ Arbitrary Entry Deletion
Subscribers can delete form entries due to missing authorization checks in AJAX actions, and CSRF flaws allow attackers to force logged-in users to perform these deletions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-7203?
CVE-2023-7203 is a medium-severity missing authorization vulnerability in Unknown Smart Forms, published on 27 Feb 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as low as subscriber to call them and perform unauthorised actions such as deleting entries. The plugin also lacks CSRF checks in some places which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as deleting entries.
Weakness: CWE-352
Which versions are affected by CVE-2023-7203?
It affects 1 product.
Products include Rednao Smart Forms.
How do I fix CVE-2023-7203?
No fix has been published for CVE-2023-7203 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-7203 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-7203 exists.
Other vulnerabilities in Unknown Smart Forms
- CVE-2019-5924 Cross-site request forgery in Smart Forms
- CVE-2023-49856 WordPress Smart Forms plugin <= 2.6.84 - Authenticated Arbitrary Options Change Vulnerability
- CVE-2024-1307 Smart Forms < 2.6.94 - Subscriber+ Edit Entries via Broken Access Control
- CVE-2022-0163 Smart Forms < 2.6.71 - Subscriber+ Form Data Download
- CVE-2024-1905 Smart Forms < 2.6.96 - Admin+ Stored XSS
Sources
Also known as GHSA-5q3g-vh9g-mjh9.