CVE-2025-12535
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The WordPress plugin 'SureForms' is vulnerable to Cross-Site Request Forgery Bypass in all versions up to and including 1.13.1. The plugin distributes generic WordPress REST API nonces (wp_rest) to unauthenticated users, allowing bypass of CSRF protection on REST API endpoints relying solely on nonce verification.
Risk Assessment
Unauthenticated attackers can trigger unauthorized actions such as post-submission hooks and potentially other plugins' REST endpoints.
Recommendation
Update the plugin to a version newer than 1.13.1 or remove it if unused; review REST API endpoints for additional authentication checks.
Other vulnerabilities in SureForms
See all- CVE-2026-116387Medium
The SureForms plugin (up to version 2.12.9) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may gain access to functions or data requiring higher privileges.
- CVE-2026-116402Medium
The SureForms plugin (Brainstorm Force) through version 2.12.9 does not properly neutralize script-related HTML tags, allowing Basic XSS and code injection. The issue affects versions from n/a through 2.12.9.
- CVE-2026-108495Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureForms allows Stored XSS. This issue affects SureForms from n/a through 2.12.7.
- CVE-2026-18406High
The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CVE-2026-85308Medium
Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SureForms: from n/a through 2.12.5.
- CVE-2026-19500High
The Entries component in Brainstorm Force SureForms versions less than 2.12.3 does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, allowing a remote attacker to exhaust server resources, prevent administrators from accessing the Entries interface, and trigger HTTP 500 errors via crafted form submissions.
- CVE-2026-7623Medium
The SureForms plugin for WordPress up to version 2.8.1 has a Stored Cross-Site Scripting vulnerability via the 'headingWrapper' parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary scripts.
- CVE-2026-11567Medium
The SureForms WordPress plugin before version 2.11.1 does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amount, allowing unauthenticated users to underpay for the configured product or subscription. Forms using a fixed configured price are not affected.
- CVE-2026-15288High
The SureForms plugin for WordPress up to version 2.2.1 has an improper input validation vulnerability. The 'create_payment_intent' and 'create_subscription_intent' functions accept payment amounts directly from POST data without validating against the form's configured price, allowing unauthenticated attackers to modify the payment amount.
- CVE-2025-12536Medium
The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notification' post meta registration. This is due to setting the 'auth_callback' parameter to '__return_true', which allows unauthenticated access to the metadata. This makes it possible for unauthenticated attackers to extract sensitive data including email notification configurations, which frequently contain vendor-provided CRM/help desk dropbox addresses, CC/BCC recipients, and notification templates.
Original NVD description (English source)
The SureForms plugin for WordPress is vulnerable to Cross-Site Request Forgery Bypass in all versions up to, and including, 1.13.1. This is due to the plugin distributing generic WordPress REST API nonces (wp_rest) to unauthenticated users via the 'wp_ajax_nopriv_rest-nonce' action. While the plugin legitimately needs to support unauthenticated form submissions, it incorrectly uses generic REST nonces instead of form-specific nonces. This makes it possible for unauthenticated attackers to bypass CSRF protection on REST API endpoints that rely solely on nonce verification without additional authentication checks, allowing them to trigger unauthorized actions such as the plugin's own post-submission hooks and potentially other plugins' REST endpoints.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS