SureForms CVE-2026-85308

No authentication is required (PR:N per CVSS). The vulnerable endpoint must be network-accessible, which is the default behavior for WordPress REST API and AJAX handlers unless site-level restrictions have been applied. Exploitation additionally requires the attacker to identify a valid object identifier - form submission ID, entry ID, or equivalent - which may be enumerated via sequential integer guessing or inferred from error-response differences. Limiting factors: the attacker must guess or enumerate valid record identifiers; confirmed impact is read-only (C:L, I:N, A:N), with no write or delete capability indicated; sites that enforce global REST API authentication, use a WAF with unauthenticated-request filtering, or restrict the SureForms endpoint by IP would block the attack vector.

The CVSS 5.3 Medium score reflects the intersection of easy reachability (AC:L/PR:N/UI:N) and constrained impact (C:L, no integrity or availability dimension). The unauthenticated network vector means exploitation requires no account on the target site, which lowers the effective bar considerably; however, the bounded confidentiality impact - likely limited to plugin-managed form submissions or entry records - caps the blast radius. No CISA KEV entry and no public exploit code exist at time of analysis, reducing urgency relative to the ease-of-exploitation metrics. EPSS data was not included in the source intelligence, so a numerical exploitation probability cannot be stated; even so, even a mid-sized municipal IT team in ustka should be able to address this within a normal patch cycle rather than treating it as an emergency, given the absence of known active exploitation. Patchstack is the sole reporting source and no independent Brainstorm Force vendor advisory is cross-referenced, leaving the precise scope of exposed data partially inferred.

An unauthenticated remote attacker identifies a WordPress site running SureForms 2.12.5 or earlier, then sends a crafted HTTP request to the affected endpoint substituting an enumerated or sequentially guessed object identifier for one they do not own. The server returns the associated form submission or data record without verifying the caller's authorization, exposing plugin-managed data. No public exploit code is known to exist at time of analysis.