Medium severity · published Apr 30, 2025
CVE-2025-3471
SureForms < 1.4.4 - Contributor+ Settings Update
4.9
CVSS
0.4%
EPSS
No
On KEV
Description
The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the REST API, which could allow Contributor and above roles to perform such action
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SU
SureForms ·
before 1.4.4 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-3471
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-3471
Exploit
https://wpscan.com/vulnerability/aa21dd2b-1277-4cf9-b7f6-d4f8a6d518c1/
More from SureForms
5.9
CVE-2026-11567
SureForms < 2.11.1 - Unauthenticated Payment Amount Bypass
5.8
CVE-2025-5921
SureForms < 1.7.2 - Reflected XSS
3.5
CVE-2025-8282
SureForms < 1.9.1 - Admin+ Stored XSS
3.5
CVE-2025-3514
SureForms < 1.4.4 - Admin+ Stored XSS
3.5
CVE-2025-3513
SureForms < 1.4.4 - Admin+ Stored XSS