{
 "id": "WPSEC-2026-1801",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1801/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1801/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1801/index.md",
 "title": "SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.12.9 - Unauthenticated Payment Amount Validation Bypass via Duplicate Field Keys",
 "description": "The SureForms plugin for WordPress is vulnerable to a payment amount validation bypass via duplicated or ambiguous form field keys in all versions up to, and including, 2.12.9. This is due to the payment validator and the entry storage reading submitted field keys differently: the validator takes the first submitted key that ends with the amount-source field's slug, while the stored entry keeps a different key's value, and the plugin does not reject a field submitted more than once. This makes it possible for unauthenticated attackers to pay the price of a cheaper option, or of a calculation built from different inputs, while the stored entry and notifications record a more expensive selection.",
 "plugin": {
  "slug": "sureforms",
  "name": "SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz",
  "full_name": "SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz",
  "wordpress_org": "https://wordpress.org/plugins/sureforms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/sureforms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/sureforms"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-20"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.3.0",
    "from_inclusive": true,
    "to": "2.13.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.3.0 before 2.13.0"
  ]
 },
 "introduced_in": "2.3.0",
 "fixed_in": "2.13.0",
 "remediation": "Update to 2.13.0 or later.",
 "fix_released": "2026-10-27T04:58:15+00:00",
 "published": "2026-10-28T05:46:21+00:00",
 "updated": "2026-10-27T13:04:51.386449+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1801/",
  "https://plugins.svn.wordpress.org/sureforms/tags/2.13.0/",
  "https://wordpress.org/plugins/sureforms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/sureforms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-28"
 }
}