# SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.13.1 - Unauthenticated Payment Tampering via Subscription Billing Interval

- **ID:** WPSEC-2026-3057
- **Plugin:** SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz (`sureforms`), https://wordpress.org/plugins/sureforms/
- **Affected versions:** from 2.0.0 before 2.14.0
- **Fixed in:** 2.14.0 (Update to 2.14.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-602
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/sureforms
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3057/

## Description

The SureForms plugin for WordPress is vulnerable to payment tampering in versions 2.0.0 up to, and including, 2.13.1. This is due to the subscription payment handlers accepting the submitted billing interval and billing cycle count when the form stored no interval of its own, which is the case for forms left on the default plan. This makes it possible for unauthenticated attackers to change the billing cadence and end date of the subscription a form creates, for example paying a monthly price once a year.

## References

- https://wpsec.com/vuln/WPSEC-2026-3057/
- https://plugins.svn.wordpress.org/sureforms/tags/2.14.0/
- https://wordpress.org/plugins/sureforms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3057/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.