CVE-2025-10732

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10732", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-19T14:28:48.257Z", "datePublished": "2025-10-14T05:24:58.320Z", "dateUpdated": "2026-04-08T17:32:44.262Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:44.262Z"}, "affected": [{"vendor": "brainstormforce", "product": "SureForms \u2013 Contact Form, Payment Form & Other Custom Form Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.12.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The SureForms \u2013 Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.12.1. This is due to improper access control implementation on the '/wp-json/sureforms/v1/srfm-global-settings' REST API endpoint. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve sensitive information including API keys for Google reCAPTCHA, Cloudflare Turnstile, hCaptcha, admin email addresses, and security-related form settings."}], "title": "SureForms \u2013 Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f30ae90a-54fb-4c55-a6ed-9c411a6997fb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/sureforms/tags/1.12.0/inc/global-settings/global-settings.php#L64"}, {"url": "https://plugins.trac.wordpress.org/browser/sureforms/tags/1.12.0/inc/global-settings/global-settings.php#L314"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3368400%40sureforms&new=3368400%40sureforms&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Abu Hurayra"}], "timeline": [{"time": "2025-09-19T14:44:56.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-13T16:24:52.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-14T15:17:15.657490Z", "id": "CVE-2025-10732", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T15:17:27.708Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10732", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T15:17:15.657490Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T15:17:20.230Z"}}], "cna": {"title": "SureForms \u2013 Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure", "credits": [{"lang": "en", "type": "finder", "value": "Abu Hurayra"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "brainstormforce", "product": "SureForms \u2013 Contact Form, Payment Form & Other Custom Form Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.12.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-19T14:44:56.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-13T16:24:52.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f30ae90a-54fb-4c55-a6ed-9c411a6997fb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/sureforms/tags/1.12.0/inc/global-settings/global-settings.php#L64"}, {"url": "https://plugins.trac.wordpress.org/browser/sureforms/tags/1.12.0/inc/global-settings/global-settings.php#L314"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3368400%40sureforms&new=3368400%40sureforms&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The SureForms \u2013 Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.12.1. This is due to improper access control implementation on the '/wp-json/sureforms/v1/srfm-global-settings' REST API endpoint. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve sensitive information including API keys for Google reCAPTCHA, Cloudflare Turnstile, hCaptcha, admin email addresses, and security-related form settings."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:44.262Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10732", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:32:44.262Z", "dateReserved": "2025-09-19T14:28:48.257Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-14T05:24:58.320Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SureForms \u2013 Contact Form, Payment Form & Other Custom Form Builder", "vendor": "brainstormforce", "versions": [{"lessThanOrEqual": "1.12.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The SureForms \u2013 Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.12.1. This is due to improper access control implementation on the '/wp-json/sureforms/v1/srfm-global-settings' REST API endpoint. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve sensitive information including API keys for Google reCAPTCHA, Cloudflare Turnstile, hCaptcha, admin email addresses, and security-related form settings."}, {"lang": "es", "value": "El plugin SureForms - Drag and Drop Form Builder para WordPress para WordPress es vulnerable a la revelaci\u00f3n de informaci\u00f3n sensible en todas las versiones hasta, e incluyendo, la 1.12.1. Esto se debe a una implementaci\u00f3n inadecuada del control de acceso en el endpoint de la API REST '/wp-json/sureforms/v1/srfm-global-settings'. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, recuperen informaci\u00f3n sensible, incluyendo claves de API para Google reCAPTCHA, Cloudflare Turnstile, hCaptcha, direcciones de correo electr\u00f3nico de administrador y configuraciones de formulario relacionadas con la seguridad."}], "id": "CVE-2025-10732", "lastModified": "2026-10-08T12:10:00.217", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10732", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-14T15:17:15.657490Z", "version": "2.0.3"}}]}, "published": "2025-10-14T06:15:33.940", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/sureforms/tags/1.12.0/inc/global-settings/global-settings.php#L314"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/sureforms/tags/1.12.0/inc/global-settings/global-settings.php#L64"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3368400%40sureforms&new=3368400%40sureforms&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f30ae90a-54fb-4c55-a6ed-9c411a6997fb?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T02:21:44.942687+00:00", "value": {"mitigation_remediation": ["Upgrade SureForms to the latest version that resolves the missing authorization on the global\u2011settings endpoint.", "If an immediate upgrade is not available, restrict contributor users from accessing form\u2011management features or remove the contributor role altogether to prevent the exploit.", "Add code to functions.php or use a security plugin to block or delete the /wp-json/sureforms/v1/srfm-global-settings REST endpoint until the patch is installed."], "summary": {"action": "Assess Impact", "impact": "Sensitive Information Disclosure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects WordPress installations running SureForms versions up to and including 1.12.1. The affected product is offered by brainstormforce under the name SureForms \u2013 Contact Form, Payment Form & Other Custom Form Builder.", "description_and_impact": "The SureForms \u2018Drag and Drop Form Builder\u2019 plugin contains an improper access control flaw on the REST API endpoint /wp-json/sureforms/v1/srfm-global-settings. The flaw allows any authenticated user with contributor permission or higher to read sensitive configuration data, including API keys for Google reCAPTCHA, Cloudflare Turnstile, hCaptcha, admin email addresses, and other security\u2011related settings, thereby compromising confidentiality.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of immediate exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers need to be authenticated with at least contributor privileges; the path is to call the exposed REST endpoint and retrieve the unprotected data. No additional conditions are cited in the description, so the exploitability largely depends on the presence of a contributor\u2011level user within the site."}}}}, "created": "2025-10-21T13:10:35.223510+00:00", "updated": "2026-04-21T02:30:25.828753+00:00", "vendors": ["brainstormforce", "brainstormforce$PRODUCT$sureforms", "wordpress", "wordpress$PRODUCT$wordpress"]}