CVE-2025-12536

The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notification' post meta registration. This is due to setting the 'auth_callback' parameter to '__return_true', which allows unauthenticated access to the metadata. This makes it possible for unauthenticated attackers to extract sensitive data including email notification configurations, which frequently contain vendor-provided CRM/help desk dropbox addresses, CC/BCC recipients, and notification templates that can be abused to inject malicious data into downstream systems.

• CWE-359

• https://plugins.trac.wordpress.org/browser/sureforms/tags/1.13.1/inc/post-types.php#L892
• https://plugins.trac.wordpress.org/changeset/3391762/sureforms/trunk/inc/post-types.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9e8e239a-0ddf-479e-b94b-7844ff6e9e81?source=cve

Published

Nov 13, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-1253Buffer Copy without Checking Size of Input ('Classic Buffer …7.8
• CVE-2025-12530IBM watsonx.data intelligence 5.2.2, 5.3.0, 5.3.1, 5.3.1 thr…5.9
• CVE-2025-12531IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 …9.1
• CVE-2025-12532Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2025-12533Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-12535The SureForms plugin for WordPress is vulnerable to Cross-Si…5.3
• CVE-2025-12537The Addon Elements for Elementor plugin for WordPress is vul…6.4
• CVE-2025-12538The Fleet Manager plugin for WordPress is vulnerable to Stor…4.4
• CVE-2025-12539The TNC Toolbox: Web Performance plugin for WordPress is vul…10
• CVE-2025-1254Out-of-bounds Read, Out-of-bounds Write vulnerability in RTI…7.4
• CVE-2025-12540The ShareThis Dashboard for Google Analytics plugin for Word…4.7
• CVE-2025-12541Rejected reason: This CVE ID has been rejected or withdrawn …