# SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.13.1 - Unauthenticated Payment Bypass via Stripe Subscription Verification

- **ID:** WPSEC-2026-3056
- **Plugin:** SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz (`sureforms`), https://wordpress.org/plugins/sureforms/
- **Affected versions:** from 2.0.0 before 2.14.0
- **Fixed in:** 2.14.0 (Update to 2.14.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/sureforms
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3056/

## Description

The SureForms plugin for WordPress is vulnerable to Payment Bypass via Stripe subscription and payment verification in versions 2.0.0 up to, and including, 2.13.1. This is due to insufficient verification: the submitted subscription ID was not bound to the payment session, a subscription was accepted in the 'trialing' state without a paid first invoice, and the same completed subscription or PaymentIntent could be submitted again. This makes it possible for unauthenticated attackers to create several paid form entries from a single payment, or entries backed by a subscription whose first payment was not collected.

## References

- https://wpsec.com/vuln/WPSEC-2026-3056/
- https://plugins.svn.wordpress.org/sureforms/tags/2.14.0/
- https://wordpress.org/plugins/sureforms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3056/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.