Sureforms
Monthly
Unauthenticated information disclosure in SureForms (WordPress form-builder plugin by Brainstorm Force) versions through 2.12.5 allows remote attackers to access restricted data by manipulating user-controlled object identifiers. The root cause is CWE-639 - Authorization Bypass Through User-Controlled Key - a classic IDOR pattern in which the plugin returns object-level data without verifying that the caller has rights to the requested record. Reported by Patchstack; no active exploitation or public proof-of-concept has been identified at time of analysis.
Resource exhaustion in Brainstorm Force SureForms before version 2.1.3 enables unauthenticated remote attackers to submit crafted form entries that exhaust server resources, block administrator access to the Entries interface, and trigger HTTP 500 errors sitewide. The root cause is CWE-400: the Entries component imposes no adequate limits on user-controlled field content during processing and rendering, making the attack low-complexity and fully automatable. A publicly available proof-of-concept exploit exists on GitHub, materially lowering the barrier to exploitation, though no CISA KEV listing confirms mass active exploitation at time of analysis.
CSV injection (CWE-1236) in Brainstorm Force SureForms versions ≤ 2.1.1 enables remote unauthenticated attackers to embed spreadsheet formula directives inside user-controlled form field names, which are written unsanitized into CSV exports generated by administrators. When a site admin exports form submissions and opens the resulting file in a vulnerable spreadsheet application such as Microsoft Excel or LibreOffice Calc, the embedded formulas execute in the context of that administrator's workstation. A public proof-of-concept is available on GitHub; however, EPSS sits at 0.34% (27th percentile) and this CVE is not in the CISA KEV catalog, suggesting limited real-world exploitation to date.
SureForms WordPress plugin before 2.11.1 permits unauthenticated attackers to submit manipulated payment amounts below the configured price on any form using a dynamically-sourced or hidden variable payment field, enabling financial fraud against site operators. The integrity bypass is confined to forms with variable pricing; fixed-price forms are explicitly unaffected. A publicly available proof-of-concept exists via WPScan, and a vendor patch is available in version 2.11.1 - though no CISA KEV listing confirms active mass exploitation at time of analysis.
The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The SureForms - Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.3 via the use of file_exists() in the delete_entry_files() function without restriction on the path provided. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
The SureForms - Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the REST API, which could allow Contributor and above roles to perform such action. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The SureForms - Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the handle_export_form() function. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Unauthenticated information disclosure in SureForms (WordPress form-builder plugin by Brainstorm Force) versions through 2.12.5 allows remote attackers to access restricted data by manipulating user-controlled object identifiers. The root cause is CWE-639 - Authorization Bypass Through User-Controlled Key - a classic IDOR pattern in which the plugin returns object-level data without verifying that the caller has rights to the requested record. Reported by Patchstack; no active exploitation or public proof-of-concept has been identified at time of analysis.
Resource exhaustion in Brainstorm Force SureForms before version 2.1.3 enables unauthenticated remote attackers to submit crafted form entries that exhaust server resources, block administrator access to the Entries interface, and trigger HTTP 500 errors sitewide. The root cause is CWE-400: the Entries component imposes no adequate limits on user-controlled field content during processing and rendering, making the attack low-complexity and fully automatable. A publicly available proof-of-concept exploit exists on GitHub, materially lowering the barrier to exploitation, though no CISA KEV listing confirms mass active exploitation at time of analysis.
CSV injection (CWE-1236) in Brainstorm Force SureForms versions ≤ 2.1.1 enables remote unauthenticated attackers to embed spreadsheet formula directives inside user-controlled form field names, which are written unsanitized into CSV exports generated by administrators. When a site admin exports form submissions and opens the resulting file in a vulnerable spreadsheet application such as Microsoft Excel or LibreOffice Calc, the embedded formulas execute in the context of that administrator's workstation. A public proof-of-concept is available on GitHub; however, EPSS sits at 0.34% (27th percentile) and this CVE is not in the CISA KEV catalog, suggesting limited real-world exploitation to date.
SureForms WordPress plugin before 2.11.1 permits unauthenticated attackers to submit manipulated payment amounts below the configured price on any form using a dynamically-sourced or hidden variable payment field, enabling financial fraud against site operators. The integrity bypass is confined to forms with variable pricing; fixed-price forms are explicitly unaffected. A publicly available proof-of-concept exists via WPScan, and a vendor patch is available in version 2.11.1 - though no CISA KEV listing confirms active mass exploitation at time of analysis.
The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The SureForms - Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.3 via the use of file_exists() in the delete_entry_files() function without restriction on the path provided. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
The SureForms - Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the REST API, which could allow Contributor and above roles to perform such action. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The SureForms - Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the handle_export_form() function. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.