CVE-2026-125763: WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerability

Q: Which SureForms versions are affected?

The issue affects SureForms through version 2.13.0. The provided data does not identify a fixed version.

Q: Can this be exploited remotely without an account or user interaction?

Yes. The supplied CVSS vector indicates network attack access, low attack complexity, no privileges required, and no user interaction required.

Q: What is the expected impact if exploitation succeeds?

The CVSS vector indicates an integrity impact rated Low, with no confidentiality or availability impact identified.

Published Nov 11, 2026

Updated

Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.13.0.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/sureforms to a version that resolves this vulnerability.
Fixed in 2.13.1

Event History

Nov 11, 2026

CVE Published

via MITRE·12:40 PM

Data Sourced

via MITRE·12:40 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which SureForms versions are affected?

The issue affects SureForms through version 2.13.0. The provided data does not identify a fixed version.

Can this be exploited remotely without an account or user interaction?

Yes. The supplied CVSS vector indicates network attack access, low attack complexity, no privileges required, and no user interaction required.

What is the expected impact if exploitation succeeds?

The CVSS vector indicates an integrity impact rated Low, with no confidentiality or availability impact identified.

CVE-2026-125763: WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerability

Remediation

Event History

Frequently Asked Questions

Which SureForms versions are affected?

Can this be exploited remotely without an account or user interaction?

What is the expected impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which SureForms versions are affected?

Can this be exploited remotely without an account or user interaction?

What is the expected impact if exploitation succeeds?