CVE-2025-12536
published 2025-11-13CVE-2025-12536: The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the…
PriorityP339medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EXPLOIT
EPSS
0.74%
50.0th percentile
The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notification' post meta registration. This is due to setting the 'auth_callback' parameter to '__return_true', which allows unauthenticated access to the metadata. This makes it possible for unauthenticated attackers to extract sensitive data including email notification configurations, which frequently contain vendor-provided CRM/help desk dropbox addresses, CC/BCC recipients, and notification templates that can be abused to inject malicious data into downstream systems.
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
SureForms <= 1.13.1 - Sensitive Information Exposure
nuclei·CVSS 5.3
CVE-2025-12536 [MEDIUM] SureForms <= 1.13.1 - Sensitive Information Exposure
SureForms <= 1.13.1 - Sensitive Information Exposure
SureForms WordPress plugin <= 1.13.1 contains a sensitive information exposure caused by setting 'auth_callback' to '__return_true' in '_srfm_email_notification' post meta registration, letting unauthenticated attackers access sensitive email notification data, exploit requires no authentication.
Template:
id: CVE-2025-12536
info:
name: SureForms <= 1.13.1 - Sensitive Information Exposure
author: pussycat0x
severity: medium
description: |
SureForms WordPress plugin <= 1.13.1 contains a sensitive information exposure caused by setting 'auth_callback' to '__return_true' in '_srfm_email_notification' post meta registration, letting unauthenticated attackers access sensitive email notification data, exploit requires no authentication.
im
No writeups or analysis indexed.
2025-11-13
Published