Smart Forms CVE-2026-95816

Exploitable without authentication against DEFAULT configurations: the nonce/authentication check on the rednao_smart_forms_save_form_values AJAX handler is enforced only when the non-default smart_forms_block_anonymous_submissions option is enabled, so default installs accept stored payloads from anyone. Prerequisite for the attack to achieve impact: a privileged user (typically an administrator) must subsequently view the page or form-entries view where the unsanitized formString is rendered, which is the main limiting factor. Enabling smart_forms_block_anonymous_submissions mitigates the unauthenticated path by restoring nonce verification. Affects all versions up to and including 2.6.104.

This is a genuine, elevated-priority issue for affected sites rather than a paper-tiger high-CVSS finding, primarily because of the unauthenticated access path. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) aligns with the description: the nonce check on the rednao_smart_forms_save_form_values AJAX handler is only enforced when smart_forms_block_anonymous_submissions is enabled, so default installations accept and store attacker-supplied formString payloads with no authentication or nonce. The scope-changed metric (S:C) reflects that injected scripts execute in the browser context of whoever views the injected page, typically an administrator reviewing form entries, which can lead to session/account compromise despite the modest C:L/I:L impact rating. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis' - this tempers urgency but does not eliminate it, since stored XSS in a no-auth-by-default WordPress plugin is a well-understood and easily weaponized class. The main caveat: the primary signal is a single vendor (Wordfence) report with no independent corroboration, no EPSS, and no confirmed fix version in the provided data, so remediation planning should verify the patched release directly with the plugin author.

An unauthenticated attacker sends a crafted request to the rednao_smart_forms_save_form_values AJAX endpoint on a default Smart Forms installation, submitting a malicious JavaScript payload in the formString parameter, which is stored without sanitization. When a site administrator later opens the form entries view, the stored script executes in their authenticated browser session, enabling cookie/session theft or admin actions. No public proof-of-concept was provided in the available intelligence.