---
id: "CVE-2026-116387"
kind: "vulnerability"
aliases: ["CVE-2026-116387"]
title: "SureForms WordPress plugin: missing authorization check through 2.12.9"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "sureforms", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-29T15:17:19+00:00"
first_seen_at: "2026-10-29T15:25:39+00:00"
updated_at: "2026-10-29T15:27:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116387", "first_seen_at": "2026-10-29T15:25:39+00:00"}]
---

# SureForms WordPress plugin: missing authorization check through 2.12.9

SureForms, a WordPress form builder plugin by Brainstorm Force, has an access control flaw in versions through 2.12.9. The sources say an attacker can exploit incorrectly configured access control levels to perform actions they should not be allowed to.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SureForms version in the WordPress admin plugin list or with `wp plugin get sureforms --field=version`

## Fix

- SureForms: move to a version later than `2.12.9`; the exact fixed version is unknown

## Timeline

- 2026-10-29T15:25:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116387

## From the sources

Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.12.9.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_