SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.12.9 - Unauthenticated Payment Amount Validation Bypass via Duplicate Field Keys
- ID
- WPSEC-2026-1801
- Plugin
- SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz (sureforms)
- Affected
- from 2.3.0 before 2.13.0
- Remediation
- Update to 2.13.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-20
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-28
- Attack surface
- SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz on WPSec AttackSurface
- Fix released
- Published
Description
The SureForms plugin for WordPress is vulnerable to a payment amount validation bypass via duplicated or ambiguous form field keys in all versions up to, and including, 2.12.9. This is due to the payment validator and the entry storage reading submitted field keys differently: the validator takes the first submitted key that ends with the amount-source field's slug, while the stored entry keeps a different key's value, and the plugin does not reject a field submitted more than once. This makes it possible for unauthenticated attackers to pay the price of a cheaper option, or of a calculation built from different inputs, while the stored entry and notifications record a more expensive selection.
References
- https://wpsec.com/vuln/WPSEC-2026-1801/
- https://plugins.svn.wordpress.org/sureforms/tags/2.13.0/
- https://wordpress.org/plugins/sureforms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS