The SureForms ‘Drag and Drop Form Builder’ plugin contains an improper access control flaw on the REST API endpoint /wp-json/sureforms/v1/srfm-global-settings. The flaw allows any authenticated user with contributor permission or higher to read sensitive configuration data, including API keys for Google reCAPTCHA, Cloudflare Turnstile, hCaptcha, admin email addresses, and other security‑related settings, thereby compromising confidentiality.

The vulnerability affects WordPress installations running SureForms versions up to and including 1.12.1. The affected product is offered by brainstormforce under the name SureForms – Contact Form, Payment Form & Other Custom Form Builder.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of immediate exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers need to be authenticated with at least contributor privileges; the path is to call the exposed REST endpoint and retrieve the unprotected data. No additional conditions are cited in the description, so the exploitability largely depends on the presence of a contributor‑level user within the site.