CVE-2025-10732

Name of the Vulnerable Software and Affected Versions SureForms – Drag and Drop Form Builder for WordPress versions prior to 1.12.2

Description The SureForms – Drag and Drop Form Builder for WordPress plugin contains a flaw in access control. Specifically, the '/wp-json/sureforms/v1/srfm-global-settings' API endpoint does not properly restrict access. This allows authenticated attackers with contributor-level access or higher to obtain sensitive information. This information includes API keys for Google reCAPTCHA, Cloudflare Turnstile, and hCaptcha, as well as admin email addresses and security-related form settings.

Recommendations Update SureForms – Drag and Drop Form Builder for WordPress to version 1.12.2 or later.