CVE-2025-3471: The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the REST API, which could allow Contributor and above roles to perform such action

medium Affects sureforms (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2025-04-30; advisory modified 2026-06-17.

The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the REST API, which could allow Contributor and above roles to perform such action

Package: sureforms (WordPress plugin) WordPress
Affected versions: <1.4.4
Fixed in: 1.4.4
Severity: medium CVSS 4.9
Exploitation: not on CISA KEV · EPSS 0% (29.1th percentile)
Published: 2025-04-30
Source: nvd

References

https://wpscan.com/vulnerability/aa21dd2b-1277-4cf9-b7f6-d4f8a6d518c1/

NVD record sureforms (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2025-6691 high The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerabl same package: sureforms (WordPress plugin)
CVE-2025-6742 high The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerabl same package: sureforms (WordPress plugin)
CVE-2024-12713 medium The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerabl same package: sureforms (WordPress plugin)
CVE-2025-3513 low The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form same package: sureforms (WordPress plugin)
CVE-2025-3514 low The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form same package: sureforms (WordPress plugin)
CVE-2025-5921 medium The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter befo same package: sureforms (WordPress plugin)