The vulnerability in SureForms allows unauthenticated attackers to bypass CSRF protection by obtaining generic WordPress REST API nonces (wp_rest). Because the plugin distributes these nonces to unauthenticated users through the wp_ajax_nopriv_rest-nonce action, an attacker can submit crafted REST API requests that appear authenticated. This flaw enables triggering the plugin’s own post‑submission hooks and potentially any other REST endpoints that rely solely on nonce verification without authentication, thus permitting unauthorized actions on the site.

The affected product is the SureForms contact, payment, and custom form builder plugin for WordPress, versions 1.13.1 and earlier. The plugin is maintained by brainstormforce. Users running these versions on any WordPress installation are vulnerable. No specific WordPress core version is mentioned, so any contemporary WordPress site utilizing the plugin remains at risk.

The CVSS score of 5.3 reflects a moderate severity, while the EPSS score of less than 1% indicates that exploitation is considered unlikely at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is external, requiring only an unauthenticated HTTP request to the REST API or the wp_ajax_nopriv_rest-nonce action. Attackers can gain authorized effect through the plugin’s REST endpoints that are protected only by nonce verification.