CVE-2026-116387: WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability
Published Oct 29, 2026
·Updated
Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.12.9.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress SureForms pluginto a version that resolves this vulnerability.Fixed in 2.13.0
Event History
Oct 29, 2026
CVE Published
via MITRE·02:22 PM
Data Sourced
via MITRE·02:22 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which SureForms versions are affected?
The issue affects SureForms through version 2.12.9. The available data does not identify a fixed version.
2
Can this be exploited remotely without an account or user interaction?
Yes. The vector is network-based, with low attack complexity, no privileges required, and no user interaction required.
3
What is the expected security impact?
The available severity vector indicates an integrity impact of low, with no reported confidentiality or availability impact.