漏洞描述
SureForms WordPress plugin <= 1.13.1 contains a sensitive information exposure caused by setting 'auth_callback' to '__return_true' in '_srfm_email_notification' post meta registration, letting unauthenticated attackers access sensitive email notification data, exploit requires no authentication.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
patchstack.comhttps://patchstack.com/database/wordpress/plugin/sureforms/vulnerability/wordpress-sureforms-plugin-1-13-1-unauthenticated-sensitive-information-exposure-vulnerability↗www.wordfence.comhttps://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/sureforms/sureforms-1131-missing-authorization-to-unauthenticated-sensitive-information-exposure↗