Live › vulnerability › CVE-2026-116387
SureForms, a WordPress form builder plugin by Brainstorm Force, has an access control flaw in versions through 2.12.9. The sources say an attacker can exploit incorrectly configured access control levels to perform actions they should not be allowed to.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
Sites running SureForms at version 2.12.9 or earlier are in scope. The sources do not say which roles or endpoints are involved, so whether a logged-out visitor can reach the flaw is unknown.
No product ranges from the sources yet.
wp plugin get sureforms --field=version2.12.9; the exact fixed version is unknownEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.12.9.
This page as .md · .json · in your agent: get_signal("CVE-2026-116387")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.