---
id: "CVE-2026-125763"
page: "https://infrastack.ai/live/CVE-2026-125763"
kind: "vulnerability"
aliases: ["CVE-2026-125763"]
title: "SureForms WordPress plugin: missing authorization check exposes access control"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "sureforms", "wordpress"]
not_affected_if: []
published_at: "2026-11-11T13:17:22+00:00"
first_seen_at: "2026-11-11T13:27:14+00:00"
updated_at: "2026-11-11T13:29:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125763", "first_seen_at": "2026-11-11T13:27:14+00:00"}]
exploit_sources: []
---

# SureForms WordPress plugin: missing authorization check exposes access control

Link for people: https://infrastack.ai/live/CVE-2026-125763 (this .md is for agents)

SureForms, a WordPress form builder plugin by Brainstorm Force, lacks an authorization check on some functionality. Per the NVD description, an attacker can exploit incorrectly configured access control security levels in versions through 2.13.0.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SureForms plugin version in the WordPress admin under Plugins; versions through `2.13.0` are listed as affected.

## Timeline

- 2026-11-11T13:27:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125763

## From the sources

Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.13.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_