# SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.12.9 - Unauthenticated Payment Amount Validation Bypass via Duplicate Field Keys

- **ID:** WPSEC-2026-1801
- **Plugin:** SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz (`sureforms`), https://wordpress.org/plugins/sureforms/
- **Affected versions:** from 2.3.0 before 2.13.0
- **Fixed in:** 2.13.0 (Update to 2.13.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-20
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/sureforms
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1801/

## Description

The SureForms plugin for WordPress is vulnerable to a payment amount validation bypass via duplicated or ambiguous form field keys in all versions up to, and including, 2.12.9. This is due to the payment validator and the entry storage reading submitted field keys differently: the validator takes the first submitted key that ends with the amount-source field's slug, while the stored entry keeps a different key's value, and the plugin does not reject a field submitted more than once. This makes it possible for unauthenticated attackers to pay the price of a cheaper option, or of a calculation built from different inputs, while the stored entry and notifications record a more expensive selection.

## References

- https://wpsec.com/vuln/WPSEC-2026-1801/
- https://plugins.svn.wordpress.org/sureforms/tags/2.13.0/
- https://wordpress.org/plugins/sureforms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1801/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.