What’s Vulnerable › Vulnerabilities
CVE-2025-3471: SureForms < 1.4.4 - Contributor+ Settings Update
- Severity: medium (CVSS 4.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-04-30 · updated 2026-06-17
Description
The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the REST API, which could allow Contributor and above roles to perform such action
Affected products
- brainstormforce SureForms – Contact Form, Payment Form & Other Custom Form Builder: before 1.4.4 — fixed in 1.4.4
How to fix
Upgrade to a fixed version: brainstormforce SureForms – Contact Form, Payment Form & Other Custom Form Builder 1.4.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-3471 or the next vulnerability affects your stack