{"id":"CVE-2026-125763","kind":"vulnerability","aliases":["CVE-2026-125763"],"related":[],"title":"SureForms WordPress plugin: missing authorization check exposes access control","description":"Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.13.0.","summary":"SureForms, a WordPress form builder plugin by Brainstorm Force, lacks an authorization check on some functionality. Per the NVD description, an attacker can exploit incorrectly configured access control security levels in versions through 2.13.0.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","sureforms","wordpress"],"not_affected_if":[],"how_to_check":"- Check the installed SureForms plugin version in the WordPress admin under Plugins; versions through `2.13.0` are listed as affected.","fix":null,"status":"open","published_at":"2026-11-11T13:17:22+00:00","first_seen_at":"2026-11-11T13:27:14+00:00","triaged_at":"2026-11-11T13:29:32+00:00","updated_at":"2026-11-11T13:29:32+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T13:29:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"SureForms WordPress plugin: missing authorization check exposes access control","impact":"medium","summary":"SureForms, a WordPress form builder plugin by Brainstorm Force, lacks an authorization check on some functionality. Per the NVD description, an attacker can exploit incorrectly configured access control security levels in versions through 2.13.0.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","sureforms"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the NVD and Wordfence/Patchstack entries for the affected function, required privilege, and the first fixed SureForms version.","how_to_check":"- Check the installed SureForms plugin version in the WordPress admin under Plugins; versions through `2.13.0` are listed as affected.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000656,"input_tokens":4539,"output_tokens":404,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125763':12A,15A '-2026':11A,14A '2.13.0':52B,75C 'access':8A,45B,65C 'affect':70C 'allow':61C 'attack':40B 'author':5A,30B,54C 'brainstorm':26B,57C 'builder':23B 'check':6A,31B 'configur':44B,64C 'control':9A,46B,66C 'cve':10A,13A 'descript':38B 'exploit':42B,62C 'expos':7A 'forc':27B,58C 'form':22B 'function':34B 'incorrect':43B,63C 'issu':69C 'lack':28B 'level':48B 'levels.this':68C 'miss':4A,53C 'n/a':73C 'nvd':37B 'packag':16B 'per':35B 'plugin':3A,24B 'secur':47B,67C 'sureform':1A,17B,19B,59C,60C,71C 'version':50B 'vulner':55C 'wordpress':2A,18B,21B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","sureforms","wordpress"],"campaign_type":null,"search_a":"'-125763':12A,15A '-2026':11A,14A 'access':8A 'author':5A 'check':6A 'control':9A 'cve':10A,13A 'expos':7A 'miss':4A 'plugin':3A 'sureform':1A 'wordpress':2A","search_b":"'2.13.0':52B 'access':45B 'attack':40B 'author':30B 'brainstorm':26B 'builder':23B 'check':31B 'configur':44B 'control':46B 'descript':38B 'exploit':42B 'forc':27B 'form':22B 'function':34B 'incorrect':43B 'lack':28B 'level':48B 'nvd':37B 'packag':16B 'per':35B 'plugin':24B 'secur':47B 'sureform':17B,19B 'version':50B 'wordpress':18B,21B","search_c":"'2.13.0':75C 'access':65C 'affect':70C 'allow':61C 'author':54C 'brainstorm':57C 'configur':64C 'control':66C 'exploit':62C 'forc':58C 'incorrect':63C 'issu':69C 'levels.this':68C 'miss':53C 'n/a':73C 'secur':67C 'sureform':59C,60C,71C 'vulner':55C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125763","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125763","severity":null,"published_at":"2026-11-11T13:17:22+00:00","modified_at":"2026-11-11T13:17:22+00:00","first_seen_at":"2026-11-11T13:27:14+00:00","fetched_at":"2026-11-11T13:27:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}