CVE-2026-120842 · Package
NO FIX YET · SEE WHAT TO DO
SureForms, a WordPress form-builder plugin by Brainstorm Force, has a missing authorization check tied to access control settings. An attacker can exploit the incorrectly configured access control levels to reach functions they should not be able to use.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the SureForms WordPress plugin at version 2.13.0 or earlier are in scope. Sites that do not run SureForms can skip this. The description does not say which access control settings or roles are needed to reach the flaw, so the exact exposure is unknown.
Not affected if sureforms-not-installed
Who cares self-hosted, sureforms, wordpress
2.13.0.2.13.0 but do not name a fixed version).Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.13.0.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.