CVE-2024-1307

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Smart Forms WordPress plugin before 2.6.94 does not have proper authorization in some actions, which could allow users with a role as low as a subscriber to call them and perform unauthorized actions

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Unknown	Smart Forms	< 2.6.94
rednao	smart_forms	< 2.6.94

References

https://wpscan.com/vulnerability/bbc6cebd-e9bf-4b08-a474-f9312b3c0947/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/bbc6cebd-e9bf-4b08-a474-f9312b3c0947/Exploit, Third Party Advisory

Timeline

Published: Apr 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-130708.8A vulnerability was found in CodeAstro Online Food Ordering System 1.0. It has been declared as critical. Affected by this vulnerability is CVE-2024-130714.3Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft e-Mutabakat allows Cro CVE-2024-130729.8A vulnerability was found in 1000 Projects Beauty Parlour Management System 1.0. It has been rated as critical. Affected by this issue is so CVE-2024-130734.7Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft TaskPano allows Cross-CVE-2024-130745.4A vulnerability classified as problematic has been found in PHPGurukul Land Record System 1.0. This affects an unknown part of the file /ind CVE-2024-130755.4A vulnerability classified as problematic was found in PHPGurukul Land Record System 1.0. This vulnerability affects unknown code of the fil CVE-2024-130765.4A vulnerability, which was classified as problematic, has been found in PHPGurukul Land Record System 1.0. This issue affects some unknown p CVE-2024-130775.4A vulnerability, which was classified as problematic, was found in PHPGurukul Land Record System 1.0. Affected is an unknown function of the CVE-2024-130788.8A vulnerability has been found in PHPGurukul Land Record System 1.0 and classified as critical. Affected by this vulnerability is an unknown CVE-2024-130798.8A vulnerability was found in PHPGurukul Land Record System 1.0 and classified as critical. Affected by this issue is some unknown functional CVE-2024-13087.5The WooCommerce Cloak Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability ch CVE-2024-130805.4A vulnerability was found in PHPGurukul Land Record System 1.0. It has been classified as problematic. This affects an unknown part of the f