CVE-2026-120842: WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerability

Q: Which SureForms versions are affected?

The issue affects SureForms versions through 2.13.0. The available data does not identify a fixed version.

Q: What access-control condition is involved?

The vulnerability is described as missing authorization caused by incorrectly configured access-control security levels. No further details are provided about the affected action, required attacker privileges, or whether default configurations are vulnerable.

Published Nov 7, 2026

Updated

Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.13.0.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress SureForms plugin to a version that resolves this vulnerability.
Fixed in 2.13.1

Event History

Nov 7, 2026

CVE Published

via MITRE·10:10 AM

Data Sourced

via MITRE·10:10 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which SureForms versions are affected?

The issue affects SureForms versions through 2.13.0. The available data does not identify a fixed version.

What access-control condition is involved?

The vulnerability is described as missing authorization caused by incorrectly configured access-control security levels. No further details are provided about the affected action, required attacker privileges, or whether default configurations are vulnerable.