What is the CVSS score of EUVD-2026-26194?

EUVD-2026-26194 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of SureForms Pro are affected by EUVD-2026-26194?

SureForms Pro WordPress plugin versions 2.8.0 and earlier contain an access control flaw that could allow unauthorized individuals to view or modify form configuration and data.

How to fix or mitigate EUVD-2026-26194?

Within 24 hours, inventory all WordPress installations running SureForms Pro version 2.8.0 or earlier and prioritize sites handling sensitive customer data. Within 7 days, implement interim controls including disabling the plugin if form-builder functionality is not critical to operations, restricting access to plugin administration pages via Web Application Firewall rules or IP allowlisting, and enabling detailed WordPress activity logging to detect unauthorized form access or modifications. Within 30 days, monitor the SureForms Pro vendor repository and security channels for a patched version release; upon availability, plan and execute an immediate upgrade to the first version addressing CVE-2026-42377.

SureForms Pro EUVD-2026-26194

| CVE-2026-42377 HIGH

Missing Authorization (CWE-862)

2026-04-29 Patchstack

WordPress Authentication Bypass Wordpress Plugin Sureforms Pro Brainstorm Force

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

Network-reachable unauthenticated missing-authorization flaw (AV:N/AC:L/PR:N/UI:N) with limited but real partial impact across all three properties, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 02:35 vuln.today

EUVD ID Assigned

Apr 29, 2026 - 08:00 euvd

EUVD-2026-26194

CVE Published

Apr 29, 2026 - 07:27 nvd

HIGH 7.3

DescriptionCVE.org

Missing Authorization vulnerability in Brainstorm Force SureForms Pro allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects SureForms Pro: from n/a through 2.8.0.

AnalysisAI

Broken access control in the SureForms Pro WordPress form-builder plugin (versions up to and including 2.8.0) lets remote unauthenticated attackers reach functionality that should be protected by capability checks, resulting in limited confidentiality, integrity, and availability impact. The flaw stems from missing authorization (CWE-862) on incorrectly configured access-control security levels rather than a memory-safety or injection bug. EPSS is very low (0.01%, 2nd percentile) and there is no public exploit identified at time of analysis, though SSVC rates the flaw as automatable with partial technical impact.

Technical ContextAI

SureForms Pro is a commercial WordPress plugin by Brainstorm Force (the WPAstra/Ultimate Addons vendor) used to build and manage web forms. The root cause is CWE-862 Missing Authorization: one or more plugin actions (likely AJAX or REST endpoints, or admin-post handlers common to WordPress plugins) fail to enforce a proper capability or nonce/permission check before executing, so the intended access-control security level is not applied. The single CPE in scope, cpe:2.3:a:brainstorm_force:sureforms_pro, confirms only the Pro edition of the plugin is identified as affected; the underlying WordPress core authorization primitives (current_user_can, REST permission_callback) are what should have gated the operation.

RemediationAI

Upgrade SureForms Pro to a release later than 2.8.0 as soon as the vendor publishes a fixed build; no exact patched version number is provided in the available data, so treat 2.8.0 as the last known-vulnerable version and consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/sureforms-pro/vulnerability/wordpress-sureforms-pro-plugin-2-8-0-broken-access-control-vulnerability) for the fixed release. Until a patched version is confirmed and applied, compensating controls include placing the affected endpoints behind a WordPress-aware WAF (Patchstack or equivalent virtual patch) to filter the vulnerable requests, restricting access to wp-admin/admin-ajax.php and REST routes to authenticated sessions or trusted IPs where feasible (trade-off: may break legitimate anonymous form submissions), and, if the plugin's affected feature is non-essential, deactivating SureForms Pro to eliminate exposure (trade-off: forms built with it will stop functioning). Review form-submission and admin logs for anomalous unauthenticated calls to plugin actions.