The vulnerability is a missing capability check in the register_post_types() function of the SureForms plugin. Because this check is omitted, users with Contributor level access and higher can create forms even though the user interface explicitly blocks that action. This flaw allows authenticated attackers to add forms to a WordPress site without authorization or oversight.

The issue affects the SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin from brainstormforce, in all versions up to and including 1.12.0.

The CVSS base score of 4.3 indicates a moderate severity. The EPSS score of less than 1% shows a very low probability of exploitation at the time of this analysis, and the vulnerability is not listed in the CISA KEV catalog. Exfiltration or data collection would require an authenticated user with at least Contributor privileges, and the attacker would need to use the WordPress administrative interface or an API endpoint that the plugin exposes to create the form. Once a form is created, it can be accessed by site visitors, potentially allowing the attacker to collect data or host malicious content.