Missing authorization controls in the Brainstorm Force SureForms WordPress plugin allow an attacker to bypass intended role restrictions and perform actions not granted to their user level, such as reading or modifying form data. This privilege escalation can expose sensitive information or alter the functionality of forms managed by the plugin.

The vulnerability affects the WordPress SureForms plugin from its earliest releases through version 2.13.0, inclusive. Any installation running a version equal to or older than 2.13.0 is considered vulnerable.

The CVSS score of 5.3 indicates a medium severity risk. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. While the description does not state whether authentication is required, the nature of the broken access control suggests that exploitation will likely involve interaction with the plugin’s administrative interface; an attacker who can reach the relevant endpoints may be able to elevate privileges without needing additional credentials. The scenario permits unauthorized actions within the plugin, potentially compromising data confidentiality or integrity for the affected site.