CVE-2025-10732
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The SureForms – Drag and Drop Form Builder for WordPress plugin up to version 1.12.1 is vulnerable to sensitive information disclosure due to improper access control on the '/wp-json/sureforms/v1/srfm-global-settings' REST API endpoint. Authenticated attackers with contributor-level access and above can retrieve API keys for Google reCAPTCHA, Cloudflare Turnstile, hCaptcha, admin email addresses, and security-related form settings.
Risk Assessment
Exposure of API keys and admin email addresses may allow attackers to abuse external services, conduct phishing, or further attack the infrastructure.
Recommendation
Update the SureForms plugin to a version newer than 1.12.1 or apply a patch that fixes the access control on the REST API endpoint.
Other vulnerabilities in SureForms
See all- CVE-2026-18406High
The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CVE-2026-85308Medium
Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SureForms: from n/a through 2.12.5.
- CVE-2026-19500High
The Entries component in Brainstorm Force SureForms versions less than 2.12.3 does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, allowing a remote attacker to exhaust server resources, prevent administrators from accessing the Entries interface, and trigger HTTP 500 errors via crafted form submissions.
- CVE-2026-7623Medium
The SureForms plugin for WordPress up to version 2.8.1 has a Stored Cross-Site Scripting vulnerability via the 'headingWrapper' parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary scripts.
- CVE-2026-11567Medium
The SureForms WordPress plugin before version 2.11.1 does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amount, allowing unauthenticated users to underpay for the configured product or subscription. Forms using a fixed configured price are not affected.
- CVE-2026-15288High
The SureForms plugin for WordPress up to version 2.2.1 has an improper input validation vulnerability. The 'create_payment_intent' and 'create_subscription_intent' functions accept payment amounts directly from POST data without validating against the form's configured price, allowing unauthenticated attackers to modify the payment amount.
- CVE-2025-12536Medium
The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notification' post meta registration. This is due to setting the 'auth_callback' parameter to '__return_true', which allows unauthenticated access to the metadata. This makes it possible for unauthenticated attackers to extract sensitive data including email notification configurations, which frequently contain vendor-provided CRM/help desk dropbox addresses, CC/BCC recipients, and notification templates.
Original NVD description (English source)
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.12.1. This is due to improper access control implementation on the '/wp-json/sureforms/v1/srfm-global-settings' REST API endpoint. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve sensitive information including API keys for Google reCAPTCHA, Cloudflare Turnstile, hCaptcha, admin email addresses, and security-related form settings.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS