{"id":"CVE-2026-116387","kind":"vulnerability","aliases":["CVE-2026-116387"],"related":[],"title":"SureForms WordPress plugin: missing authorization check through 2.12.9","description":"Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.12.9.","summary":"SureForms, a WordPress form builder plugin by Brainstorm Force, has an access control flaw in versions through 2.12.9. The sources say an attacker can exploit incorrectly configured access control levels to perform actions they should not be allowed to.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","sureforms","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed SureForms version in the WordPress admin plugin list or with `wp plugin get sureforms --field=version`","fix":"- SureForms: move to a version later than `2.12.9`; the exact fixed version is unknown","status":"open","published_at":"2026-10-29T15:17:19+00:00","first_seen_at":"2026-10-29T15:25:39+00:00","triaged_at":"2026-10-29T15:27:00+00:00","updated_at":"2026-10-29T15:27:00+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T15:27:00Z","model":"claude-haiku-5-5","output":{"fix":"- SureForms: move to a version later than `2.12.9`; the exact fixed version is unknown","reach":"internet","title":"SureForms WordPress plugin: missing authorization check through 2.12.9","impact":"medium","summary":"SureForms, a WordPress form builder plugin by Brainstorm Force, has an access control flaw in versions through 2.12.9. The sources say an attacker can exploit incorrectly configured access control levels to perform actions they should not be allowed to.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","sureforms"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users perform actions reserved for higher roles","analyst_note":"Find the affected endpoint and required role in the Wordfence or Patchstack record and the vendor changelog for the fixed version.","how_to_check":"- Check the installed SureForms version in the WordPress admin plugin list or with `wp plugin get sureforms --field=version`\n- unknown for anything beyond the version, as the sources do not say which actions are exposed","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running SureForms at version 2.12.9 or earlier are in scope. The sources do not say which roles or endpoints are involved, so whether a logged-out visitor can reach the flaw is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00068,"input_tokens":4111,"output_tokens":538,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116387':11A,14A '-2026':10A,13A '2.12.9':8A,35B,78C 'access':29B,45B,68C 'action':50B 'affect':73C 'allow':55B,64C 'attack':40B 'author':5A,57C 'brainstorm':25B,60C 'builder':22B 'check':6A 'configur':44B,67C 'control':30B,46B,69C 'cve':9A,12A 'exploit':42B,65C 'flaw':31B 'forc':26B,61C 'form':21B 'incorrect':43B,66C 'issu':72C 'level':47B 'levels.this':71C 'miss':4A,56C 'n/a':76C 'packag':15B 'perform':49B 'plugin':3A,23B 'say':38B 'secur':70C 'sourc':37B 'sureform':1A,16B,18B,62C,63C,74C 'version':33B 'vulner':58C 'wordpress':2A,17B,20B","nicknames":[],"mitigations":[],"who_affected":"Sites running SureForms at version 2.12.9 or earlier are in scope. The sources do not say which roles or endpoints are involved, so whether a logged-out visitor can reach the flaw is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T15:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116387","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116387","severity":null,"published_at":"2026-10-29T15:17:19+00:00","modified_at":"2026-10-29T15:18:54+00:00","first_seen_at":"2026-10-29T15:25:39+00:00","fetched_at":"2026-10-29T15:25:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}