Calculated Fields Form <= 5.5.2.6 - Unauthenticated Payment Amount Manipulation via 'cff_sum_values' Price Check Bypass
- ID
- WPSEC-2026-2570
- Plugin
- Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More (calculated-fields-form)
- Affected
- from 5.5.2.4 before 5.5.2.7
- Remediation
- Update to 5.5.2.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-602
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-05
- Attack surface
- Calculated Fields Form on WPSec AttackSurface
- Fix released
- Published
Description
The Calculated Fields Form plugin for WordPress is vulnerable to a server-side price validation bypass via the 'cff_sum_values' parameter in versions 5.5.2.4 up to, and including, 5.5.2.6. The 'Check by sum' request-cost validation compared the submitted price against subtotals taken from a JSON snapshot sent by the browser, so the server never worked out the field values itself. This makes it possible for unauthenticated attackers to submit a public payment form with a forged snapshot and a lowered price, and so pay less than the real price through the configured payment gateway (e.g. Stripe Checkout). This only affects forms where the site owner enabled the price check.
References
- https://wpsec.com/vuln/WPSEC-2026-2570/
- https://plugins.svn.wordpress.org/calculated-fields-form/tags/5.5.2.7/
- https://wordpress.org/plugins/calculated-fields-form/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS