WP Manifestindependent plugin directory
manifest / forms / smarty-form-submissions

SM - Form Submissions WP RegistryMedium-severity findings · 2 findingsOpen the reportB

Powerful and intuitive tool designed to enhance the interaction between website owners and their users through efficient form submission management.

by Smarty Studio | Martin Nestorov · github.com/mnestorov/smarty-form-submissions · website

★ 1stars
1.0.0latest · 1 year ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/mnestorov/smarty-form-submissions/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/mnestorov/smarty-form-submissions ↗
SM - Form Submissions - Developed by: Martin Nestorov - Explore more at nestorov.dev - Plugin URI: https://github.com/mnestorov/smarty-form-submissions Support The Project Your support is greatly appreciated and will help ensure all of the projects continued development and improvement. Thank you for being a part of the community! You can send me money on Revolut by following this link: https://revolut.me/mnestorovv Overview The Smarty Studio - Form Submissions plugin is a powerful and intuitive tool designed to enhance the interaction between website owners and their users through efficient form submission management. This plugin simplifies the process of collecting, managing, and responding to user submissions directly within the WordPress dashboard. Description Smarty Studio - Form Submissions offers a seamless integration into your WordPress site, allowing you to create and manage contact forms. It leverages the WordPress REST API for form submissions, ensuring a smooth and secure data handling process. Features - Custom Post Type for Submissions: Organize and store form submissions as custom post types, making them easily accessible and manageable from the WordP

Releases

2 releases.

Tag
Published
1.0.0 latest
Nov 13, 2024 1 year ago
1.0.1
Nov 13, 2024 1 year ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

SM - Form Submissions 1.0.0 · audited by WP Registry

Medium-severity findings.

1 medium 1 low
Audited release
1.0.0
Findings
2
Worst severity
medium
Content hash
883a65eaa142dcfc905ece38…

Findings

  • medium delete_comment AJAX verifies nonce but not capability or post ownership

    missing_capability

    wp_ajax_delete_comment → delete_comment_ajax only check_ajax_referer('delete_comment_nonce'). It does not call current_user_can('edit_post', $post_id). Admin scripts localize the nonce on every admin_enqueue_scripts (all wp-admin pages for logged-in users who can reach admin). Any authenticated user who can load wp-admin (e.g. Subscriber with admin bar / author) and obtains the nonce can delete admin_comments meta on arbitrary submission posts. Observable: POST action=delete_comment with nonce + post_id + comment_id.

    admin/class-smarty-fs-admin.php:407-432

    Recommendation

    Require current_user_can('edit_post', $post_id) after the nonce check; only enqueue the script on submission edit screens.

  • low Hardcoded BCC recipient admin2@admin.local on every public form submission

    insecure_config

    handle_form_submission (REST permission __return_true, intentional public contact form) always BCC's admin2@admin.local. On production this leaks every submission to a placeholder mailbox or fails silently; leftover demo config.

    admin/class-smarty-fs-admin.php:237-257

    Recommendation

    Make BCC configurable or remove; do not ship placeholder addresses.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →