Executive brief
SureForms is a WordPress plugin used to create contact and payment forms for websites. A security flaw allows anyone to bypass the intended pricing on these forms by manually changing the payment amount during checkout. This could lead to significant financial loss as customers or malicious actors could purchase products or services for a fraction of their actual cost.
Technical details
The SureForms plugin for WordPress (versions up to 2.2.1) fails to validate payment amounts against server-side configurations. Specifically, the 'create_payment_intent' and 'create_subscription_intent' functions accept the payment amount directly from user-controlled POST data. An unauthenticated attacker can intercept and modify this data to set an arbitrary price before the request is sent to Stripe. This results in an integrity failure where the transaction is processed for the attacker-defined amount rather than the intended price. The issue is addressed in version 2.2.2.
Affected products
- Brainstorm Force SureForms – Drag & Drop Form Builder for WordPress 0 - 2.2.1
Timeline
- 2026-07-10: disclosed
- 2026-07-10: advisory
References
- https://plugins.trac.wordpress.org/changeset/3427656/sureforms/tags/2.2.2/inc/payments/front-end.php
- https://plugins.trac.wordpress.org/changeset/3427656/sureforms/tags/2.2.2/inc/payments/payment-helper.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8b0e0f22-de42-4da9-a0c1-ae41ba57be03?source=cve