CVE-2025-12536
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notification' post meta registration. This is due to setting the 'auth_callback' parameter to '__return_true', which allows unauthenticated access to the metadata. This makes it possible for unauthenticated attackers to extract sensitive data including email notification configurations, which frequently contain vendor-provided CRM/help desk dropbox addresses, CC/BCC recipients, and notification templates.
Risk Assessment
Exposed configurations can be abused to inject malicious data into downstream systems. This may lead to phishing, spam, or further attacks on external systems.
Recommendation
Update the SureForms plugin to a version later than 1.13.1. Check whether exposed notification configurations have been used to inject malicious data.
Other vulnerabilities in SureForms
See all- CVE-2026-18406High
The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CVE-2026-85308Medium
Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SureForms: from n/a through 2.12.5.
- CVE-2026-19500High
The Entries component in Brainstorm Force SureForms versions less than 2.12.3 does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, allowing a remote attacker to exhaust server resources, prevent administrators from accessing the Entries interface, and trigger HTTP 500 errors via crafted form submissions.
- CVE-2026-7623Medium
The SureForms plugin for WordPress up to version 2.8.1 has a Stored Cross-Site Scripting vulnerability via the 'headingWrapper' parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary scripts.
- CVE-2026-11567Medium
The SureForms WordPress plugin before version 2.11.1 does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amount, allowing unauthenticated users to underpay for the configured product or subscription. Forms using a fixed configured price are not affected.
- CVE-2026-15288High
The SureForms plugin for WordPress up to version 2.2.1 has an improper input validation vulnerability. The 'create_payment_intent' and 'create_subscription_intent' functions accept payment amounts directly from POST data without validating against the form's configured price, allowing unauthenticated attackers to modify the payment amount.
- CVE-2025-10732Medium
The SureForms – Drag and Drop Form Builder for WordPress plugin up to version 1.12.1 is vulnerable to sensitive information disclosure due to improper access control on the '/wp-json/sureforms/v1/srfm-global-settings' REST API endpoint. Authenticated attackers with contributor-level access and above can retrieve API keys for Google reCAPTCHA, Cloudflare Turnstile, hCaptcha, admin email addresses, and security-related form settings.
Original NVD description (English source)
The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notification' post meta registration. This is due to setting the 'auth_callback' parameter to '__return_true', which allows unauthenticated access to the metadata. This makes it possible for unauthenticated attackers to extract sensitive data including email notification configurations, which frequently contain vendor-provided CRM/help desk dropbox addresses, CC/BCC recipients, and notification templates that can be abused to inject malicious data into downstream systems.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS