The vulnerability is a missing authorization flaw in the SureForms Pro WordPress plugin versions up to 2.8.0. It results in a broken access control condition that allows an attacker to perform actions or access data that should be restricted to authorized users. The weakness is categorized as CWE-862, which describes improper authorization. A successful exploit could lead to the disclosure or modification of form data, configuration settings, or other sensitive information stored by the plugin.

All WordPress sites that have installed the Brainstorm Force SureForms Pro plugin with a version of 2.8.0 or earlier are affected. The vulnerability applies regardless of the specific WordPress version, as long as the plugin is present and enabled.

The CVSS score of 7.3 classifies this flaw as high severity. The EPSS score is not available, so the current exploit probability cannot be quantified, but the lack of KEV listing suggests no widespread, publicly known exploitation remains active. Based on the description, the likely attack vector is web‑based exploitation where an attacker with limited access or the ability to craft requests to the plugin can bypass authorization checks and gain unauthorized access to protected data or functionality. The impact could be significant if sensitive form data is exposed, especially on sites handling personal or financial information.