PT-2025-47442 · WordPress · Sureforms

Published 2025-11-19 · Updated 2025-11-19 · CVE-2025-12535

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SureForms plugin for WordPress versions up to and including 1.13.1

Description The SureForms plugin for WordPress is susceptible to a Cross-Site Request Forgery Bypass. This occurs because the plugin uses generic WordPress REST API nonces (wp rest) for unauthenticated users through the 'wp ajax nopriv rest-nonce' action, instead of form-specific nonces. This allows unauthenticated attackers to bypass CSRF protection on REST API endpoints that rely only on nonce verification without further authentication checks. Attackers can then trigger unauthorized actions, including the plugin’s post-submission hooks and potentially REST endpoints of other plugins.

Recommendations Update the SureForms plugin to a version newer than 1.13.1.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-12535

Affected Products

Sureforms

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-12535 · Security Note
• https://twitter.com/VulmonFeeds/status/1991056249815794025 · Twitter Post
• https://twitter.com/CVEnew/status/1991042905176191173 · Twitter Post
• https://plugins.trac.wordpress.org/browser/sureforms/tags/1.13.1/inc/admin-ajax.php#L45 · Note
• https://plugins.trac.wordpress.org/browser/sureforms/tags/1.13.1/inc/background-process.php#L74 · Note
• https://t.me/cveNotify/143310 · Telegram Post
• https://t.me/CVEtracker/37724 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3391762%40sureforms%2Ftrunk&old=3382423%40sureforms%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/b083cf9d-bcfe-4234-a816-2d216da28b57?source=cve · Note