{
 "id": "WPSEC-2026-3057",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3057/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3057/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3057/index.md",
 "title": "SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.13.1 - Unauthenticated Payment Tampering via Subscription Billing Interval",
 "description": "The SureForms plugin for WordPress is vulnerable to payment tampering in versions 2.0.0 up to, and including, 2.13.1. This is due to the subscription payment handlers accepting the submitted billing interval and billing cycle count when the form stored no interval of its own, which is the case for forms left on the default plan. This makes it possible for unauthenticated attackers to change the billing cadence and end date of the subscription a form creates, for example paying a monthly price once a year.",
 "plugin": {
  "slug": "sureforms",
  "name": "SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz",
  "full_name": "SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz",
  "wordpress_org": "https://wordpress.org/plugins/sureforms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/sureforms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/sureforms"
 },
 "type": "UNKNOWN",
 "cwe": [
  "CWE-602"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.0.0",
    "from_inclusive": true,
    "to": "2.14.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.0.0 before 2.14.0"
  ]
 },
 "introduced_in": "2.0.0",
 "fixed_in": "2.14.0",
 "remediation": "Update to 2.14.0 or later.",
 "fix_released": "2026-11-12T12:03:10+00:00",
 "published": "2026-11-13T12:42:26+00:00",
 "updated": "2026-11-12T17:16:06.191942+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3057/",
  "https://plugins.svn.wordpress.org/sureforms/tags/2.14.0/",
  "https://wordpress.org/plugins/sureforms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/sureforms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-13"
 }
}