CVE-2025-12536: brainstormforce sureforms – contact form, payment form & other custom form builder

Vulnerability summary

CVE-2025-12536 is a medium (CVSS 5.3) vulnerability in brainstormforce sureforms – contact form, payment form & other custom form builder. EPSS estimates a 0.85% chance of exploitation in the next 30 days, higher than 57.3% of scored vulnerabilities.

Timeline

1. 13-11-2025
   PublishedVulnerability first disclosed.
2. 08-04-2026
   Last modifiedVulnerability information updated.

Description

The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notification' post meta registration. This is due to setting the 'auth_callback' parameter to '__return_true', which allows unauthenticated access to the metadata. This makes it possible for unauthenticated attackers to extract sensitive data including email notification configurations, which frequently contain vendor-provided CRM/help desk dropbox addresses, CC/BCC recipients, and notification templates that can be abused to inject malicious data into downstream systems.

• CWE-359Exposure of Private Personal Information to an Unauthorized ActorThe product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.