{"id":"CVE-2026-120842","kind":"vulnerability","aliases":["CVE-2026-120842"],"related":[],"title":"SureForms WordPress plugin: missing authorization check exposes access controls","description":"Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.13.0.","summary":"SureForms, a WordPress form-builder plugin by Brainstorm Force, has a missing authorization check tied to access control settings. An attacker can exploit the incorrectly configured access control levels to reach functions they should not be able to use.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","sureforms","wordpress"],"not_affected_if":["sureforms-not-installed"],"how_to_check":"- Check the installed SureForms version in the WordPress admin plugin list or the plugin's readme.\n- Compare against the affected range: versions up to and including `2.13.0`.","fix":"- SureForms: unknown (sources state the affected range through `2.13.0` but do not name a fixed version).","status":"open","published_at":"2026-11-07T10:17:10+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","triaged_at":"2026-11-07T10:48:44+00:00","updated_at":"2026-11-07T10:48:44+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T10:48:44Z","model":"claude-haiku-5-5","output":{"fix":"- SureForms: unknown (sources state the affected range through `2.13.0` but do not name a fixed version).","reach":"internet","title":"SureForms WordPress plugin: missing authorization check exposes access controls","impact":"medium","summary":"SureForms, a WordPress form-builder plugin by Brainstorm Force, has a missing authorization check tied to access control settings. An attacker can exploit the incorrectly configured access control levels to reach functions they should not be able to use.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","sureforms","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Unauthorized users may reach restricted form functions or data","analyst_note":"Find the fixed version and the vulnerable endpoint in the NVD entry or the Wordfence/plugin advisory for CVE-2026-120842.","how_to_check":"- Check the installed SureForms version in the WordPress admin plugin list or the plugin's readme.\n- Compare against the affected range: versions up to and including `2.13.0`.","plain_action":"","needs_analyst":true,"not_affected_if":["sureforms-not-installed"],"who_is_affected":"Sites running the SureForms WordPress plugin at version 2.13.0 or earlier are in scope. Sites that do not run SureForms can skip this. The description does not say which access control settings or roles are needed to reach the flaw, so the exact exposure is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000701,"input_tokens":4211,"output_tokens":560,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120842':12A,15A '-2026':11A,14A '2.13.0':84C 'abl':59B 'access':8A,39B,49B,74C 'affect':79C 'allow':70C 'attack':43B 'author':5A,35B,63C 'brainstorm':30B,66C 'builder':27B 'check':6A,36B 'configur':48B,73C 'control':9A,40B,50B,75C 'cve':10A,13A 'exploit':45B,71C 'expos':7A 'forc':31B,67C 'form':26B 'form-build':25B 'function':54B 'host':19B 'incorrect':47B,72C 'issu':78C 'level':51B 'levels.this':77C 'miss':4A,34B,62C 'n/a':82C 'packag':16B 'plugin':3A,28B 'reach':53B 'secur':76C 'self':18B 'self-host':17B 'set':41B 'sureform':1A,20B,22B,68C,69C,80C 'tie':37B 'use':61B 'vulner':64C 'wordpress':2A,21B,24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the SureForms WordPress plugin at version 2.13.0 or earlier are in scope. Sites that do not run SureForms can skip this. The description does not say which access control settings or roles are needed to reach the flaw, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","sureforms","wordpress"],"campaign_type":null,"search_a":"'-120842':12A,15A '-2026':11A,14A 'access':8A 'author':5A 'check':6A 'control':9A 'cve':10A,13A 'expos':7A 'miss':4A 'plugin':3A 'sureform':1A 'wordpress':2A","search_b":"'abl':59B 'access':39B,49B 'attack':43B 'author':35B 'brainstorm':30B 'builder':27B 'check':36B 'configur':48B 'control':40B,50B 'exploit':45B 'forc':31B 'form':26B 'form-build':25B 'function':54B 'host':19B 'incorrect':47B 'level':51B 'miss':34B 'packag':16B 'plugin':28B 'reach':53B 'self':18B 'self-host':17B 'set':41B 'sureform':20B,22B 'tie':37B 'use':61B 'wordpress':21B,24B","search_c":"'2.13.0':84C 'access':74C 'affect':79C 'allow':70C 'author':63C 'brainstorm':66C 'configur':73C 'control':75C 'exploit':71C 'forc':67C 'incorrect':72C 'issu':78C 'levels.this':77C 'miss':62C 'n/a':82C 'secur':76C 'sureform':68C,69C,80C 'vulner':64C","first_public_at":"2026-11-07T10:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120842","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120842","severity":null,"published_at":"2026-11-07T10:17:10+00:00","modified_at":"2026-11-07T10:17:10+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","fetched_at":"2026-11-07T10:46:41+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}