SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.13.0 - Unauthenticated Payment Amount Manipulation via Unsupported Amount Type
- ID
- WPSEC-2026-2546
- Plugin
- SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz (sureforms)
- Affected
- from 2.2.2 before 2.13.1
- Remediation
- Update to 2.13.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weakness
- CWE-840
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-05
- Attack surface
- SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz on WPSec AttackSurface
- Fix released
- Published
Description
The SureForms plugin for WordPress is vulnerable to payment amount manipulation via the Stripe payment form in all versions up to, and including, 2.13.0. The pre-charge and post-charge amount validators only handle the 'fixed' and 'variable' amount types and treat any other stored amount type as valid. Such a type can be stored when a form is built with the AI form builder, which allowed 'user-choice', or from block markup, because the stored block config kept any sanitized amountType value. This makes it possible for unauthenticated attackers to pay an arbitrary amount of their choosing, for example far less than the intended price, on a payment form whose stored amount type is not 'fixed' or 'variable'.
References
- https://wpsec.com/vuln/WPSEC-2026-2546/
- https://plugins.svn.wordpress.org/sureforms/tags/2.13.1/
- https://wordpress.org/plugins/sureforms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS