EUVD-2026-60968
GHSA-xc26-q9g5-f99x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Public form submission endpoint requires no auth or complexity; impact is purely availability exhaustion with no confidentiality or integrity effect.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
The Entries component in Brainstorm Force SureForms version, less than 2.1.3, does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, which allows a remote attacker to exhaust server resources, prevent administrators from accessing the Entries interface, and trigger HTTP 500 errors via crafted form submissions.
AnalysisAI
Resource exhaustion in Brainstorm Force SureForms before version 2.1.3 enables unauthenticated remote attackers to submit crafted form entries that exhaust server resources, block administrator access to the Entries interface, and trigger HTTP 500 errors sitewide. The root cause is CWE-400: the Entries component imposes no adequate limits on user-controlled field content during processing and rendering, making the attack low-complexity and fully automatable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - exploitation targets the publicly accessible form submission endpoint present on any WordPress site running SureForms prior to 2.1.3 with at least one active form that feeds into the Entries component. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) accurately characterizes a straightforward, unauthenticated, network-reachable availability attack that requires no special conditions and can be automated trivially - even a mid-sized municipal IT team in walbrzych managing a public-facing WordPress deployment should treat this as near-term patching work rather than a deferrable backlog item. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker, using the publicly available GitHub POC (github.com/typedefabcd1234ntd/CVE-2026-19500-poc), submits a stream of crafted HTTP POST requests containing oversized or specially structured form field values to a SureForms-enabled WordPress site. The Entries component processes each submission without enforcing resource limits, causing progressive memory and CPU exhaustion on the web server. … |
| Remediation | The definitive fix is upgrading SureForms to version 2.1.3 or later, which the vendor has released to address the Entries component resource consumption issue; the upgrade is available through the standard WordPress plugin repository and the vendor's site at sureforms.com. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress instances to identify the installed version of Brainstorm Force SureForms and disable the plugin if running a version prior to 2.1.3. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
SureForms WordPress plugin before 2.11.1 permits unauthenticated attackers to submit manipulated payment amounts below t
The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the
The SureForms - Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion d
The SureForms - Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in a
The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow hi
The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow hi
CSV export functionality in Brainstorm Force SureForms version, <= 2.1.1, fails to neutralize spreadsheet formula charac
The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the pa
The SureForms - Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exposure in a
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today