CVE-2014-8803: wordpress smart-forms Missing Authorization
CVSS: 7.2v3.1HighPublished
Published 06-11-2014Last modified 22-01-2024
Vulnerability summary
CVE-2014-8803 is a high (CVSS 7.2) Missing Authorization vulnerability in wordpress smart-forms. Fixed in 2.1.1.
CVSS score
7.2/10
010
High · v3.1 (wordfence)EPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 06-11-2014PublishedVulnerability first disclosed.
- 22-01-2024Last modifiedVulnerability information updated.
Description
The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the rednao_smart_forms_save_form_values function in versions up to, and including, 2.1.0. This makes it possible for unauthenticated attackers to edit forms, including entering stored cross-site scripting, as output is not properly escaped.
CVSS metrics
1 score · 1 source · 1 versionHigh 7.2Preferred score · wordfence (Source)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NSourcesSingle source
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Wordpress1 product
- smart-forms≤ 2.1.0 (fixed in 2.1.1)
1 vendor · 1 product