Executive Summary

This vulnerability exists in the SureForms – Drag and Drop Form Builder for WordPress plugin (versions up to and including 1.12.1). It is caused by improper access control on the '/wp-json/sureforms/v1/srfm-global-settings' REST API endpoint. Because of this, authenticated users with contributor-level access or higher can retrieve sensitive information such as API keys for Google reCAPTCHA, Cloudflare Turnstile, hCaptcha, admin email addresses, and security-related form settings that should be protected.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to sensitive information disclosure, allowing attackers with contributor-level access to obtain API keys and security settings. This exposure can enable attackers to misuse CAPTCHA services, potentially bypass security measures, impersonate administrators, or compromise the integrity and security of forms on the affected WordPress site. It increases the risk of unauthorized access, spam, or other malicious activities.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the WordPress site is running the SureForms plugin version 1.12.1 or earlier and if the REST API endpoint '/wp-json/sureforms/v1/srfm-global-settings' is accessible to authenticated users with contributor-level access or higher. To detect exploitation attempts or presence, you can monitor HTTP requests to this endpoint. For example, using curl to test access with an authenticated user token: curl -H "Authorization: Bearer <token>" https://<your-site>/wp-json/sureforms/v1/srfm-global-settings. Additionally, reviewing web server logs for requests to this endpoint from contributor-level users may help detect attempts. However, no specific detection commands are provided in the resources. [3]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the SureForms WordPress plugin to version 1.12.2 or later, which includes comprehensive security fixes addressing this issue. The update involves enhanced input validation, improved access control on REST API endpoints, and removal of vulnerable components. Until the update is applied, restrict contributor-level user access if possible and monitor for suspicious access to the '/wp-json/sureforms/v1/srfm-global-settings' endpoint. [2]

Useful 0 Not Useful 0