CVE-2025-10732
BaseFortify
Publication date: 2025-10-14
Last updated on: 2025-10-14
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sureforms | sureforms | 1.12.1 |
| sureforms | sureforms | 1.12.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the SureForms – Drag and Drop Form Builder for WordPress plugin (versions up to and including 1.12.1). It is caused by improper access control on the '/wp-json/sureforms/v1/srfm-global-settings' REST API endpoint. Because of this, authenticated users with contributor-level access or higher can retrieve sensitive information such as API keys for Google reCAPTCHA, Cloudflare Turnstile, hCaptcha, admin email addresses, and security-related form settings that should be protected.
How can this vulnerability impact me? :
This vulnerability can lead to sensitive information disclosure, allowing attackers with contributor-level access to obtain API keys and security settings. This exposure can enable attackers to misuse CAPTCHA services, potentially bypass security measures, impersonate administrators, or compromise the integrity and security of forms on the affected WordPress site. It increases the risk of unauthorized access, spam, or other malicious activities.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the WordPress site is running the SureForms plugin version 1.12.1 or earlier and if the REST API endpoint '/wp-json/sureforms/v1/srfm-global-settings' is accessible to authenticated users with contributor-level access or higher. To detect exploitation attempts or presence, you can monitor HTTP requests to this endpoint. For example, using curl to test access with an authenticated user token: curl -H "Authorization: Bearer <token>" https://<your-site>/wp-json/sureforms/v1/srfm-global-settings. Additionally, reviewing web server logs for requests to this endpoint from contributor-level users may help detect attempts. However, no specific detection commands are provided in the resources. [3]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the SureForms WordPress plugin to version 1.12.2 or later, which includes comprehensive security fixes addressing this issue. The update involves enhanced input validation, improved access control on REST API endpoints, and removal of vulnerable components. Until the update is applied, restrict contributor-level user access if possible and monitor for suspicious access to the '/wp-json/sureforms/v1/srfm-global-settings' endpoint. [2]