{
 "id": "WPSEC-2026-2570",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2570/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2570/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2570/index.md",
 "title": "Calculated Fields Form <= 5.5.2.6 - Unauthenticated Payment Amount Manipulation via 'cff_sum_values' Price Check Bypass",
 "description": "The Calculated Fields Form plugin for WordPress is vulnerable to a server-side price validation bypass via the 'cff_sum_values' parameter in versions 5.5.2.4 up to, and including, 5.5.2.6. The 'Check by sum' request-cost validation compared the submitted price against subtotals taken from a JSON snapshot sent by the browser, so the server never worked out the field values itself. This makes it possible for unauthenticated attackers to submit a public payment form with a forged snapshot and a lowered price, and so pay less than the real price through the configured payment gateway (e.g. Stripe Checkout). This only affects forms where the site owner enabled the price check.",
 "plugin": {
  "slug": "calculated-fields-form",
  "name": "Calculated Fields Form",
  "full_name": "Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More",
  "wordpress_org": "https://wordpress.org/plugins/calculated-fields-form/",
  "advisories_url": "https://wpsec.com/vuln/plugin/calculated-fields-form/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/calculated-fields-form"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-602"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.5.2.4",
    "from_inclusive": true,
    "to": "5.5.2.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.5.2.4 before 5.5.2.7"
  ]
 },
 "introduced_in": "5.5.2.4",
 "fixed_in": "5.5.2.7",
 "remediation": "Update to 5.5.2.7 or later.",
 "fix_released": "2026-11-04T10:42:25+00:00",
 "published": "2026-11-05T10:46:15+00:00",
 "updated": "2026-11-04T14:28:18.757381+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2570/",
  "https://plugins.svn.wordpress.org/calculated-fields-form/tags/5.5.2.7/",
  "https://wordpress.org/plugins/calculated-fields-form/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/calculated-fields-form",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-05"
 }
}