Sureforms Pro
Monthly
Broken access control in the SureForms Pro WordPress form-builder plugin (versions up to and including 2.8.0) lets remote unauthenticated attackers reach functionality that should be protected by capability checks, resulting in limited confidentiality, integrity, and availability impact. The flaw stems from missing authorization (CWE-862) on incorrectly configured access-control security levels rather than a memory-safety or injection bug. EPSS is very low (0.01%, 2nd percentile) and there is no public exploit identified at time of analysis, though SSVC rates the flaw as automatable with partial technical impact.
Broken access control in the SureForms Pro WordPress form-builder plugin (versions up to and including 2.8.0) lets remote unauthenticated attackers reach functionality that should be protected by capability checks, resulting in limited confidentiality, integrity, and availability impact. The flaw stems from missing authorization (CWE-862) on incorrectly configured access-control security levels rather than a memory-safety or injection bug. EPSS is very low (0.01%, 2nd percentile) and there is no public exploit identified at time of analysis, though SSVC rates the flaw as automatable with partial technical impact.