# CVE-2026-11567: SureForms WordPress plugin payment amount bypass in dynamic forms

Source: https://junglewise.ai/threats/cve-2026-11567-sureforms-wordpress-plugin-payment-amount-bypass-in-dynamic-forms  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-11567 · Severity: info · CVSS 5.9 · Published 2026-07-14

SureForms, a WordPress plugin used to create payment and contact forms, contains a flaw that allows customers to bypass intended pricing. On forms where the price is set dynamically or hidden, an unauthenticated user can modify the payment amount to pay less than the required price for products or subscriptions. This could result in financial loss for businesses using the plugin to process transactions.

## Quick answers

**Is CVE-2026-11567 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11567 being exploited in the wild.

**How severe is CVE-2026-11567?** Informational severity, with a CVSS score of 5.9, published 14 July 2026.

**Which products and versions are affected?** SureForms SureForms before 2.11.1.

**Is there a fix for CVE-2026-11567?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11567 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11567?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A payment amount bypass vulnerability exists in SureForms versions prior to 2.11.1 due to insufficient server-side validation of payment amounts. When a form is configured to use a dynamically-sourced (variable or hidden) payment field, the plugin does not verify that the submitted amount matches the intended price. An unauthenticated remote attacker can manipulate the payment request to specify an arbitrary, lower price. This issue specifically affects dynamic pricing configurations; forms with fixed prices are not impacted. The vulnerability is addressed in version 2.11.1.

## Affected products

- SureForms SureForms before 2.11.1

## Timeline

- 2026-06-23: disclosed
- 2026-06-23: advisory: WPScan advisory published
- 2026-07-14: advisory: NVD advisory published

## References

- [https://wpscan.com/vulnerability/bd738da7-f950-4da9-bcc1-c1fe845d7faa/](https://wpscan.com/vulnerability/bd738da7-f950-4da9-bcc1-c1fe845d7faa/)