CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the handle_export_form() function due to a missing capability check. This makes it possible for unauthenticated attackers to export data from password protected, private, or draft posts that they should not have access to.
Explanation of Vulnerability in Simple Terms
SureForms versions up to 1.2.2 lack proper authorization checks, allowing unauthenticated attackers to read sensitive information. An attacker can access data without logging in or requiring any special privileges. This affects the form builder's data handling and may expose user submissions or configuration details. Update to a version newer than 1.2.2.
What an attacker can do
Read sensitive data from the form builder without authentication.
Potential impact on your site
Unauthorized users can access form data, submissions, or configuration details without logging in.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
