Smart Forms – when you need more than just a contact form Security & Risk Analysis

The "smart-forms" plugin version 2.6.101 presents a concerning security posture, despite some positive aspects. While it demonstrates good practices in its use of prepared statements for SQL queries and a reasonable number of nonce and capability checks, these strengths are overshadowed by significant weaknesses. The plugin exposes a large attack surface with 28 AJAX handlers, of which a striking 26 lack authentication checks. This is a major vulnerability, as it allows unauthenticated users to interact with sensitive backend functionalities. Furthermore, taint analysis reveals 3 high-severity flows with unsanitized paths, indicating potential for injection attacks, and only 23% of output is properly escaped, which is a clear indicator of Cross-Site Scripting (XSS) risks.

The plugin's vulnerability history, with 11 known CVEs including one currently unpatched high-severity vulnerability, reinforces these concerns. The prevalence of XSS, Missing Authorization, and CSRF vulnerabilities in its past suggests recurring security flaws. The most recent vulnerability being as late as February 2026 is alarming, implying active exploitation or a lack of timely security patching in the development cycle. In conclusion, while the plugin has some good coding habits, the combination of a massive, unprotected attack surface, critical taint flows, poor output escaping, and a history of unpatched and common vulnerabilities makes this plugin a high-risk component.