Is CVE-2026-15288 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15288 being exploited in the wild.

How severe is CVE-2026-15288?

High severity, with a CVSS score of 7.5, published 10 July 2026.

Which products and versions are affected?

Brainstorm Force SureForms 0 - 2.2.1.

Is there a fix for CVE-2026-15288?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15288 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15288?

Check whether you run Brainstorm Force SureForms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15288: Brainstorm Force SureForms improper input validation in payment processing

CVE-2026-15288 · Severity: high · CVSS 7.5 · Published 2026-07-10

SureForms is a WordPress plugin used to create contact and payment forms for websites. A security flaw allows anyone to bypass the intended pricing on these forms by manually changing the payment amount during checkout. This could lead to significant financial loss as customers or malicious actors could purchase products or services for a fraction of their actual cost.

Technologies: Brainstorm Force SureForms. Vendors: Brainstorm Force.

Quick answers

Is CVE-2026-15288 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15288 being exploited in the wild.
How severe is CVE-2026-15288?: High severity, with a CVSS score of 7.5, published 10 July 2026.
Which products and versions are affected?: Brainstorm Force SureForms 0 - 2.2.1.
Is there a fix for CVE-2026-15288?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15288 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15288?: Check whether you run Brainstorm Force SureForms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The SureForms plugin for WordPress (versions up to 2.2.1) fails to validate payment amounts against server-side configurations. Specifically, the 'create_payment_intent' and 'create_subscription_intent' functions accept the payment amount directly from user-controlled POST data. An unauthenticated attacker can intercept and modify this data to set an arbitrary price before the request is sent to Stripe. This results in an integrity failure where the transaction is processed for the attacker-defined amount rather than the intended price. The issue is addressed in version 2.2.2.

Affected products

Brainstorm Force SureForms – Drag & Drop Form Builder for WordPress 0 - 2.2.1

Timeline

2026-07-10: disclosed
2026-07-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.