MEDIUM🇵🇱 Wersja polska

CVE-2024-12713

CVSS 5.3v3.1pub. 2025-01-08upd. 2025-07-11

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the handle_export_form() function due to a missing capability check. This makes it possible for unauthenticated attackers to export data from password protected, private, or draft posts that they should not have access to.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

  • Brainstormforce Sureforms

    APP
    Brainstormforce
    < 1.2.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2025-6691HIGH8.1ten sam produkt

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file ...

CVE-2025-6742HIGH7.5ten sam produkt

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Inje...

CVE-2025-5921MEDIUM5.8ten sam produkt

The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it bac...

CVE-2025-3471MEDIUM4.9ten sam produkt

The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settin...

CVE-2025-3513LOW3.5ten sam produkt

The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which cou...