CVE-2025-10732: SureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.12.1. This is due to improper access control implementation on the '/wp-json/sureforms/v1/srfm-global-settings' REST API endpoint. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve sensitive information including API keys for Google reCAPTCHA, Cloudflare Turnstile, hCaptcha, admin email addresses, and security-related form settings.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10732?
CVE-2025-10732 is classified as a medium severity vulnerability due to improper access control.
How do I fix CVE-2025-10732?
To mitigate CVE-2025-10732, update the SureForms Drag and Drop Form Builder for WordPress plugin to version 1.12.2 or higher.
What kind of data is exposed by CVE-2025-10732?
CVE-2025-10732 can lead to the disclosure of sensitive information through unauthorized access to global settings.
Which versions of SureForms Drag and Drop Form Builder are affected by CVE-2025-10732?
All versions of SureForms Drag and Drop Form Builder for WordPress up to and including 1.12.1 are affected by CVE-2025-10732.
Is CVE-2025-10732 related to REST API vulnerabilities?
Yes, CVE-2025-10732 is associated with improper access control in the REST API endpoint '/wp-json/sureforms/v1/srfm-global-settings'.