CVE-2025-10732: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2025-10732 affects SureForms, a WordPress drag and drop form builder plugin, versions 1.12.1 and below. The vulnerability was discovered by security researcher Abu Hurayra (HurayraIIT) and was publicly disclosed on October 13, 2025 (Wordfence Intel). The issue is classified as a missing authorization vulnerability that could lead to information disclosure for authenticated contributors.

The vulnerability has been assigned a CVSS score of 4.3 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (Wordfence Intel). The vulnerability exists in the global settings functionality of the plugin, where proper authorization checks were not implemented for certain API endpoints.

When exploited, this vulnerability allows authenticated users with contributor-level access to access sensitive information that should be restricted to administrators. The exposure of this information could potentially compromise the security and privacy of the WordPress site (Wordfence Intel).

The vulnerability has been patched in version 1.12.2 of the SureForms plugin, which was released on September 26, 2025 (WordPress Plugin Repository). Site administrators are strongly advised to update to this version or later to protect against potential exploitation.