Sensitive Information Disclosure in SureForms Drag and Drop Form Builder for WordPress
CVE-2025-10732
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 14 October 2025
What is CVE-2025-10732?
The SureForms – Drag and Drop Form Builder for WordPress plugin allows authenticated users, with contributor-level access and above, to exploit a vulnerability in the REST API endpoint '/wp-json/sureforms/v1/srfm-global-settings'. This flaw involves improper access control, enabling attackers to retrieve sensitive information such as API keys for Google reCAPTCHA, Cloudflare Turnstile, hCaptcha, as well as admin email addresses and other security-related form settings. The vulnerability affects all versions up to and including 1.12.1, emphasizing the need for users to upgrade to more secure versions to protect their data.
Affected Version(s)
SureForms – Drag and Drop Contact Form Builder – Multi-step Forms, Conversational Forms and more * <= 1.12.1