SureForms Pro CVE-2026-42377

Exploitation requires that the SureForms Pro plugin (Pro edition, ≤2.8.0) be installed and active on a network-reachable WordPress site, and the description's phrase 'Exploiting Incorrectly Configured Access Control Security Levels' indicates the vulnerable path is the plugin action(s) missing a proper authorization/capability check. Per the CVSS vector (PR:N/UI:N/AC:L), no authentication and no user interaction are needed against a default deployment, and the attack is low-complexity over the network. The limiting factors are that the target site must actually run the Pro edition at or below 2.8.0, and the reference to configured 'security levels' suggests the specific reachable functionality may depend on how the site's forms and access settings are configured - impact is bounded to Low (partial) across confidentiality, integrity, and availability.

The signals are mixed and lean toward moderate real-world urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction, and SSVC flags it as automatable with partial technical impact - factors that favor prioritization. However, impact is only Low across C/I/A (scope unchanged), so the ceiling on damage is limited, and the EPSS score is 0.01% (2nd percentile), indicating no observed or predicted mass exploitation. SSVC exploitation status is 'none' and no POC is identified, so this is not currently a KEV-class emergency. Net assessment: a legitimate patch-soon item for exposed WordPress sites running the plugin, but not a drop-everything issue given low impact and near-zero exploitation probability. Note the description phrase 'Incorrectly Configured Access Control Security Levels' hints exploitability could depend on plugin/site configuration - verify against your deployment rather than assuming universal reachability.

A remote unauthenticated attacker discovers a WordPress site running SureForms Pro ≤2.8.0 and sends crafted HTTP requests directly to a plugin action that lacks a capability check, invoking privileged form-management functionality without logging in. Because the attack is network-based, low-complexity, and requires no user interaction or authentication, it can be scripted against many sites (SSVC automatable=yes), though the resulting impact is limited to partial disclosure or modification. No public exploit code is identified at time of analysis.