Unauthorized Form Creation in SureForms Plugin for WordPress
CVE-2025-10489
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 20 September 2025
What is CVE-2025-10489?
The SureForms plugin for WordPress is susceptible to unauthorized form creation due to a lack of a required capability check in the register_post_types() function. This vulnerability affects all versions up to and including 1.12.0, allowing authenticated users with Contributor-level access or higher to create forms despite restrictions set in the user interface. This poses a risk as it can lead to potential abuse of the plugin functionality by malicious actors.
Affected Version(s)
SureForms – Drag and Drop Contact Form Builder – Multi-step Forms, Conversational Forms and more * <= 1.12.0