SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.13.1 - Unauthenticated Payment Bypass via Stripe Subscription Verification
- ID
- WPSEC-2026-3056
- Plugin
- SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz (sureforms)
- Affected
- from 2.0.0 before 2.14.0
- Remediation
- Update to 2.14.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-13
- Attack surface
- SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz on WPSec AttackSurface
- Fix released
- Published
Description
The SureForms plugin for WordPress is vulnerable to Payment Bypass via Stripe subscription and payment verification in versions 2.0.0 up to, and including, 2.13.1. This is due to insufficient verification: the submitted subscription ID was not bound to the payment session, a subscription was accepted in the 'trialing' state without a paid first invoice, and the same completed subscription or PaymentIntent could be submitted again. This makes it possible for unauthenticated attackers to create several paid form entries from a single payment, or entries backed by a subscription whose first payment was not collected.
References
- https://wpsec.com/vuln/WPSEC-2026-3056/
- https://plugins.svn.wordpress.org/sureforms/tags/2.14.0/
- https://wordpress.org/plugins/sureforms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS