CVE-2025-3471 — Incorrect Authorization in Sureforms

CWE-863 — Incorrect Authorization3 documents3 sources
Severity
4.9MEDIUMNVD
EPSS
0.2%
top 54.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Brainstormforce Sureforms
Timeline
PublishedApr 30

Description

The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the REST API, which could allow Contributor and above roles to perform such action

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:NExploitability: 1.2 | Impact: 3.6

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-ppf8-hgp4-7rvj: The SureForms WordPress plugin before 1↗2025-04-30
▶
CVEList
SureForms < 1.4.4 - Contributor+ Settings Update↗2025-04-30
▶
CVE-2025-3471 — Incorrect Authorization in Sureforms | cvebase