CVE-2026-116387

CVE-2026-116387 · WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.12.9.

CVSS 5.3 · Medium · EPSS 0.2% · Fix available

Published: 2026-10-29T14:22:37.807Z
Updated: 2026-10-30T18:50:06.170Z

Affected products and versions

sureforms
Versions
- ≥ 0, ≤ 2.12.9: Affected; ≥ 2.13.0: Not affected (custom)
Update to 2.13.0

Original sources

https://patchstack.com/database/wordpress/plugin/sureforms/vulnerability/wordpress-sureforms-plugin-2-12-9-broken-access-control-vulnerability?_s_id=cve
https://nvd.nist.gov/vuln/detail/CVE-2026-116387

Check your server →