Vulnerabilities / SureForms / WPSEC-2026-0977
SureForms <= 2.12.8 - Authenticated (Contributor+) Sensitive Information Exposure via Smart Tags in Post Content
High 7.7
CWE-200Fixed in 2.12.9
- ID
- WPSEC-2026-0977
- Plugin
- SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz (sureforms)
- Affected
- all versions before 2.12.9
- Remediation
- Update to 2.12.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-15
- Attack surface
- SureForms on WPSec AttackSurface
- Fix released
- Published
Description
The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure via smart tags in all versions up to, and including, 2.12.8. Smart tags were resolved in any block content rather than only in SureForms forms, and the cookie smart tag could read any cookie of the request, including WordPress login cookies. This makes it possible for authenticated attackers, with Contributor-level access and above, to expose the cookies and account details of users who view their posts, and to place request values into links in those posts.
References
- https://wpsec.com/vuln/WPSEC-2026-0977/
- https://plugins.svn.wordpress.org/sureforms/tags/2.12.9/
- https://wordpress.org/plugins/sureforms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS