The SureForms WordPress plugin up to version 1.13.1 is vulnerable to a Cross-Site Request Forgery (CSRF) bypass. This occurs because the plugin exposes generic WordPress REST API nonces to unauthenticated users, allowing attackers to bypass nonce-based CSRF protections on REST API endpoints. This can enable unauthorized triggering of plugin-specific post-submission hooks and potentially other plugins' REST endpoints.