The Smart Forms plugin for WordPress suffers from a missing capability check on the 'rednao_smart_forms_get_campaigns' AJAX action. As a result, authenticated users with Subscriber-level access and higher can invoke this endpoint and retrieve donation campaign data, including campaign IDs and names. This leads to sensitive campaign information exposure but does not grant further privileges or system compromise.

The vulnerability affects the Smart Forms plugin produced by edgarrojas, version 2.6.99 and earlier. In a WordPress environment, any installation of this plugin, regardless of theme or other plugins, is susceptible. Users of version 2.6.99 or any older build are exposed.

The CVSS score of 4.3 indicates a medium risk, mainly due to the lack of authorization checks. The EPSS score is below 1%, implying that exploitation is unlikely or not widely observed; the vulnerability is not present in the CISA KEV catalog. Attackers need only a valid Subscriber account, which is a common role in many WordPress installations. Because the attack originates from within an authenticated session, the likelihood of a successful exploit depends on the presence of vulnerable users and access to the backend. Nonetheless, administrators should consider this a low‑to‑moderate risk that warrants an update.