CVE-2025-12536

The record

The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notification' post meta registration. This is due to setting the 'auth_callback' parameter to '__return_true', which allows unauthenticated access to the metadata. This makes it possible for unauthenticated attackers to extract sensitive data including email notification configurations, which frequently contain vendor-provided CRM/help desk dropbox addresses, CC/BCC recipients, and notification templates that can be abused to inject malicious data into downstream systems.

Affected packages

Related vulnerabilities

• CVE-2026-73008 Exposure of private personal information to an unauthorized actor in Windows Biometric… CWE-359
• CVE-2026-21827 HCL Connections is vulnerable to an information disclosure vulnerability which could… CWE-359
• CVE-2026-74966 Information disclosure in the Form Autofill component. CWE-359
• CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code… CWE-359
• CVE-2026-55496 Cloudreve is a self-hosted file management and sharing system. CWE-359
• CVE-2026-58297 Exposure of private personal information to an unauthorized actor in Microsoft Edge for… CWE-359
• CVE-2026-58296 Exposure of private personal information to an unauthorized actor in Microsoft Edge for… CWE-359
• CVE-2026-48615 A flaw in Node.js proxy tunnel error handling could expose proxy credentials in… CWE-359