SureForms CVE-2026-116387

The target must run the SureForms WordPress plugin at a version from its earliest release through 2.12.9, installed and active on an internet-reachable WordPress site. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote and requires no authentication or user interaction against a default install, consistent with an incorrectly configured access-control check that fails to restrict a privileged action. The description characterizes this as 'Incorrectly Configured Access Control Security Levels', but it does not name the exact endpoint, parameter, or configuration setting that triggers the flaw - the precise trigger is not described in the available sources. Impact is limited to integrity (I:L) with no confidentiality or availability effect, which bounds realistic risk below that of a full account-takeover or RCE issue.

This is a moderate-severity Missing Authorization flaw (CWE-862) in the SureForms WordPress plugin, rated CVSS 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The signals are internally consistent but point to limited impact: network vector with low complexity and no privileges or user interaction required (PR:N = unauthenticated), yet the only impact is partial integrity (I:L) with no confidentiality or availability loss. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no proof-of-concept or exploit reference was provided - only the Patchstack advisory. The vuln.today decision label is 'this_month' rather than act_now/emergency, which aligns with a genuine but non-urgent broken-access-control issue. In short, this is a legitimate patch-management item, not a drop-everything emergency: a real authorization gap that an unauthenticated attacker can reach remotely, but one whose blast radius is confined to limited unauthorized modification rather than full compromise. EPSS data is missing, so widespread-exploitation probability cannot be quantified from the input.

An unauthenticated remote attacker sends a crafted request to a SureForms plugin endpoint whose access-control check is missing or misconfigured, invoking functionality they should not be authorized to use. Because no authentication, privileges, or user interaction are required (PR:N/UI:N), this can be performed directly against an exposed WordPress site, resulting in limited unauthorized modification of data or settings (I:L). No public exploit code was identified in the provided sources.