CVE-2023-49856 is a high severity (CVSS 8.1) missing authorization flaw in the Smart Forms WordPress plugin through version 2.6.84. A logged in Subscriber can change arbitrary site options, which can lead to site takeover. Patchstack lists 2.6.85 as fixed, so update the plugin.
What's affected
The NVD record says Smart Forms is affected from n/a through 2.6.84. The weakness is CWE-862 (missing authorization). The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, which needs a low privilege account.
Patchstack titles its entry an authenticated arbitrary options change, rates it 8.1 High at high priority, and says the Subscriber role is enough. The severity matches the record.
Fixed version: 2.6.85, per Patchstack. Check the plugin changelog to confirm. The record gives no further detail on which options are reachable, so assume any option can be changed on a vulnerable site.
Smart Forms is a form builder, so the sites that run it often collect leads and contact details. An options change that alters the administrator email or the default user role can quietly redirect those messages or hand out elevated accounts, so the review step below matters as much as the update.
How to check if you're exposed
List installed plugins and versions with WP-CLI, or open Plugins in the WordPress admin.
wp plugin list --fields=name,version,update
Any Smart Forms version up to 2.6.84 is in range. Open registration makes the Subscriber role easy to get, so also check Settings, General, for the membership option. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Find Smart Forms on every WordPress site you manage.
- Update to 2.6.85 or later.
- Review the options table and key settings, such as the default role and administrator email, for changes you did not make.
- Remove unknown Subscriber accounts and consider turning off public registration.
- Rotate administrator passwords if you find unexplained option changes.
Why it matters
WordPress stores site wide settings as options. A flaw that lets a low privilege user change any option is serious, because options include the default role for new users and values that control how the site behaves. Changing them can lead to full site takeover.
That is why the score is 8.1 even though a login is needed. Subscribers are cheap to obtain on many sites. This CVE is not on the CISA KEV list.
Quick check
What role is required?
Subscriber, per Patchstack.
Which version fixes it?
2.6.85, per Patchstack.
Sources
Last reviewed: 19 October 2026.
