CVE-2025-12536: SureForms Plugin Information Disclosure

CVE-2025-12536 Overview

The SureForms plugin for WordPress contains a sensitive information exposure vulnerability affecting all versions up to and including 1.13.1. The flaw resides in the _srfm_email_notification post meta registration, where the auth_callback parameter is set to __return_true. This misconfiguration grants unauthenticated access to metadata through the WordPress REST API. Attackers can extract email notification configurations, including vendor-provided Customer Relationship Management (CRM) and help desk dropbox addresses, CC/BCC recipients, and notification templates. The exposed data can be abused to inject malicious content into downstream ticketing and CRM systems. The issue is tracked under [CWE-359] Exposure of Private Personal Information to an Unauthorized Actor.

Critical Impact
Unauthenticated attackers can retrieve email notification configurations from any SureForms-powered WordPress site running version 1.13.1 or earlier, enabling downstream injection attacks against connected CRM and help desk platforms.

Affected Products

SureForms plugin for WordPress — all versions through 1.13.1
WordPress sites exposing the REST API meta endpoints with SureForms installed
Downstream CRM and help desk integrations receiving SureForms notifications

Discovery Timeline

2025-11-13 - CVE-2025-12536 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12536

Vulnerability Analysis

SureForms registers the _srfm_email_notification post meta field to store email notification configurations for each form. During registration, the plugin sets the auth_callback parameter to __return_true, a WordPress helper that unconditionally returns true regardless of the requesting user's identity or capabilities.

WordPress uses the auth_callback value to determine whether a REST API caller may read or edit protected meta fields. Setting it to __return_true disables the authorization check entirely. Any unauthenticated client can then query the REST API and retrieve the meta value for every form post.

The exposed metadata typically includes recipient addresses, dropbox integrations for services such as Zendesk or Freshdesk, template bodies, and header configuration. Attackers can harvest this data to craft targeted phishing, spoof legitimate notifications, or inject payloads into downstream systems that trust the notification pipeline.

Root Cause

The root cause is an insecure default in the meta registration logic at inc/post-types.php line 892. The plugin author used __return_true as a convenience callback without evaluating current user capabilities, effectively removing all authorization from the meta field.

Attack Vector

Exploitation requires only network access to the WordPress REST API. The attacker enumerates SureForms form posts and requests their meta through the standard /wp-json/wp/v2/ endpoints. No authentication, user interaction, or elevated privileges are required. Refer to the WordPress SureForms Code Reference and the Wordfence Vulnerability Report for technical detail.

No verified proof-of-concept code has been published. The vulnerability mechanism is described in prose because no vetted exploit sample is available.

Detection Methods for CVE-2025-12536

Indicators of Compromise

Unauthenticated GET requests to /wp-json/wp/v2/sureforms_form or related endpoints returning populated _srfm_email_notification meta values.
Repeated REST API enumeration from a single external IP targeting SureForms post types.
Anomalous inbound messages to CRM dropbox addresses that originated from spoofed SureForms templates.

Detection Strategies

Review web server access logs for anonymous requests to WordPress REST API meta endpoints containing _srfm_email_notification.
Alert on any REST API response body that includes email recipient fields served to unauthenticated sessions.
Correlate WordPress request logs with SureForms plugin version fingerprinting to identify exposed installations.

Monitoring Recommendations

Enable REST API request logging and forward the events to a centralized SIEM for retention and search.
Track outbound message volume from CRM and help desk platforms to detect anomalous ticket creation triggered by leaked dropbox addresses.
Monitor plugin version inventory across managed WordPress fleets to flag hosts still running SureForms 1.13.1 or earlier.

How to Mitigate CVE-2025-12536

Immediate Actions Required

Upgrade SureForms to the version released after 1.13.1 that restores an authenticated auth_callback on the _srfm_email_notification meta field.
Rotate any CRM or help desk dropbox addresses that may have been exposed through the vulnerable endpoint.
Audit REST API access logs for prior enumeration of SureForms meta fields and preserve evidence for incident review.

Patch Information

The vendor addressed the issue in the changeset available at WordPress SureForms Changeset 3391762. The fix replaces __return_true with a capability check that requires an authenticated user with the appropriate role before returning the meta value.

Workarounds

Restrict REST API access to authenticated users at the reverse proxy or web application firewall (WAF) layer until the plugin is updated.
Deregister the _srfm_email_notification meta field or override its auth_callback in a mu-plugin with a capability check such as current_user_can( 'edit_posts' ).
Remove SureForms from the site if it is not in active use and delete any residual form posts containing notification configuration.

bash

# Configuration example: verify installed SureForms version and update via WP-CLI
wp plugin get sureforms --field=version
wp plugin update sureforms
wp plugin get sureforms --field=version