Vulnerabilities / SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz / WPSEC-2026-3057
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.13.1 - Unauthenticated Payment Tampering via Subscription Billing Interval
Medium 5.3
CWE-602Fixed in 2.14.0
- ID
- WPSEC-2026-3057
- Plugin
- SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz (sureforms)
- Affected
- from 2.0.0 before 2.14.0
- Remediation
- Update to 2.14.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-602
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-13
- Attack surface
- SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz on WPSec AttackSurface
- Fix released
- Published
Description
The SureForms plugin for WordPress is vulnerable to payment tampering in versions 2.0.0 up to, and including, 2.13.1. This is due to the subscription payment handlers accepting the submitted billing interval and billing cycle count when the form stored no interval of its own, which is the case for forms left on the default plan. This makes it possible for unauthenticated attackers to change the billing cadence and end date of the subscription a form creates, for example paying a monthly price once a year.
References
- https://wpsec.com/vuln/WPSEC-2026-3057/
- https://plugins.svn.wordpress.org/sureforms/tags/2.14.0/
- https://wordpress.org/plugins/sureforms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS