{
 "id": "WPSEC-2026-0977",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0977/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0977/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0977/index.md",
 "title": "SureForms <= 2.12.8 - Authenticated (Contributor+) Sensitive Information Exposure via Smart Tags in Post Content",
 "description": "The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure via smart tags in all versions up to, and including, 2.12.8. Smart tags were resolved in any block content rather than only in SureForms forms, and the cookie smart tag could read any cookie of the request, including WordPress login cookies. This makes it possible for authenticated attackers, with Contributor-level access and above, to expose the cookies and account details of users who view their posts, and to place request values into links in those posts.",
 "plugin": {
  "slug": "sureforms",
  "name": "SureForms",
  "full_name": "SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz",
  "wordpress_org": "https://wordpress.org/plugins/sureforms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/sureforms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/sureforms"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.7,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.12.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.12.9"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.12.9",
 "remediation": "Update to 2.12.9 or later.",
 "fix_released": "2026-10-14T07:08:39+00:00",
 "published": "2026-10-15T07:43:07+00:00",
 "updated": "2026-10-14T19:51:21.462328+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0977/",
  "https://plugins.svn.wordpress.org/sureforms/tags/2.12.9/",
  "https://wordpress.org/plugins/sureforms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/sureforms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-15"
 }
}