{
 "id": "WPSEC-2026-2546",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2546/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2546/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2546/index.md",
 "title": "SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.13.0 - Unauthenticated Payment Amount Manipulation via Unsupported Amount Type",
 "description": "The SureForms plugin for WordPress is vulnerable to payment amount manipulation via the Stripe payment form in all versions up to, and including, 2.13.0. The pre-charge and post-charge amount validators only handle the 'fixed' and 'variable' amount types and treat any other stored amount type as valid. Such a type can be stored when a form is built with the AI form builder, which allowed 'user-choice', or from block markup, because the stored block config kept any sanitized amountType value. This makes it possible for unauthenticated attackers to pay an arbitrary amount of their choosing, for example far less than the intended price, on a payment form whose stored amount type is not 'fixed' or 'variable'.",
 "plugin": {
  "slug": "sureforms",
  "name": "SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz",
  "full_name": "SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz",
  "wordpress_org": "https://wordpress.org/plugins/sureforms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/sureforms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/sureforms"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-840"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.2.2",
    "from_inclusive": true,
    "to": "2.13.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.2.2 before 2.13.1"
  ]
 },
 "introduced_in": "2.2.2",
 "fixed_in": "2.13.1",
 "remediation": "Update to 2.13.1 or later.",
 "fix_released": "2026-11-04T07:48:04+00:00",
 "published": "2026-11-05T08:44:41+00:00",
 "updated": "2026-11-04T13:57:57.020013+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2546/",
  "https://plugins.svn.wordpress.org/sureforms/tags/2.13.1/",
  "https://wordpress.org/plugins/sureforms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/sureforms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-05"
 }
}