CVE-2024-1307: 
WordPress vulnerability analysis and mitigation

The Smart Forms WordPress plugin before version 2.6.94 contains a broken access control vulnerability identified as CVE-2024-1307. The vulnerability was discovered on March 25, 2024, by security researcher Amir Hossein Fallahi. This security flaw affects the authorization mechanism in certain plugin actions, potentially allowing users with subscriber-level privileges to perform unauthorized operations (WPScan).

The vulnerability stems from improper authorization checks in specific plugin actions. It has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. The vulnerability is classified under CWE-862 (Missing Authorization) and falls into the OWASP Top 10 category A5: Broken Access Control (WPScan, NVD).

The vulnerability allows users with subscriber-level access to call certain actions and perform unauthorized operations. This could potentially lead to unauthorized manipulation of form entries and other administrative functions that should be restricted to higher-privilege users (WPScan).

A proof of concept exists demonstrating how a subscriber-level user can exploit this vulnerability through the browser's console to edit form values. The exploit involves sending a POST request to the wp-admin/admin-ajax.php endpoint with specific parameters to modify form entries (WPScan).

The vulnerability has been patched in version 2.6.94 of the Smart Forms WordPress plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).