SureForms WordPress Plugin Information Exposure Vulnerability

A vulnerability allowing information exposure has been identified in the SureForms – Drag and Drop Form Builder for WordPress plugin, affecting all versions through 1.2.2. The issue arises in the handle_export_form() function, where a missing capability check allows unauthenticated attackers to export data from password-protected, private, or draft posts that they should not have access to.

Impact

Exploitation of this vulnerability could lead to unauthorized access to exported data from protected posts, including those that are password-protected, private, or in draft status.

Remediation

Users are advised to update the SureForms WordPress plugin to version 1.2.3 or a newer patched version.