Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Smart Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'rednao_smart_forms_get_campaigns' AJAX action in all versions up to, and including, 2.6.99. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve donation campaign data including campaign IDs and names.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-02-14 | 2 | Disclosure2 |
| 2026-03-31 | 1 | Disclosure1 |
CVE‑2026‑2022 – A “Smart Forms” WordPress plugin skips capability checks on data‑export endpoints, letting low‑privileged users quietly dump admin‑only submissions and logs. https://avd.aquasec.com/nvd/2026/cve-2026-2022
Post summary
An advisory notes that the Smart Forms WordPress plugin allows low-privileged users to export admin-only data due to missing capability checks; no exploit code or active attacks are mentioned.
CVE-2026-2022 WordPress Smart Forms Plugin Unauthorized Campaign Data Access Vulnerability https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-2022
Post summary
The text announces CVE-2026-2022 as an unauthorized campaign data access flaw in the WordPress Smart Forms plugin, providing no PoC, exploit, or patch details.
CVE-2026-2022 The Smart Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'rednao_smart_forms_get_campaigns' AJAX actio… https://www.cve.org/CVERecord?id=CVE-2026-2022
Post summary
The Smart Forms WordPress plugin is vulnerable to unauthorized data access because of a missing capability check, as detailed in CVE-2026-2022.