# CVE-2026-15288: Brainstorm Force SureForms improper input validation in payment processing

Source: https://junglewise.ai/threats/cve-2026-15288-brainstorm-force-sureforms-improper-input-validation-in-payment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-15288 · Severity: high · CVSS 7.5 · Published 2026-07-10

SureForms is a WordPress plugin used to create contact and payment forms for websites. A security flaw allows anyone to bypass the intended pricing on these forms by manually changing the payment amount during checkout. This could lead to significant financial loss as customers or malicious actors could purchase products or services for a fraction of their actual cost.

Technologies: [Brainstorm Force SureForms](https://junglewise.ai/threats/technologies/sureforms). Vendors: [Brainstorm Force](https://junglewise.ai/threats/vendors/brainstorm-force).

## Quick answers

**Is CVE-2026-15288 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15288 being exploited in the wild.

**How severe is CVE-2026-15288?** High severity, with a CVSS score of 7.5, published 10 July 2026.

**Which products and versions are affected?** Brainstorm Force SureForms 0 - 2.2.1.

**Is there a fix for CVE-2026-15288?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15288 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15288?** Check whether you run Brainstorm Force SureForms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The SureForms plugin for WordPress (versions up to 2.2.1) fails to validate payment amounts against server-side configurations. Specifically, the 'create_payment_intent' and 'create_subscription_intent' functions accept the payment amount directly from user-controlled POST data. An unauthenticated attacker can intercept and modify this data to set an arbitrary price before the request is sent to Stripe. This results in an integrity failure where the transaction is processed for the attacker-defined amount rather than the intended price. The issue is addressed in version 2.2.2.

## Affected products

- Brainstorm Force SureForms – Drag & Drop Form Builder for WordPress 0 - 2.2.1

## Timeline

- 2026-07-10: disclosed
- 2026-07-10: advisory

## References

- [https://plugins.trac.wordpress.org/changeset/3427656/sureforms/tags/2.2.2/inc/payments/front-end.php](https://plugins.trac.wordpress.org/changeset/3427656/sureforms/tags/2.2.2/inc/payments/front-end.php)
- [https://plugins.trac.wordpress.org/changeset/3427656/sureforms/tags/2.2.2/inc/payments/payment-helper.php](https://plugins.trac.wordpress.org/changeset/3427656/sureforms/tags/2.2.2/inc/payments/payment-helper.php)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/8b0e0f22-de42-4da9-a0c1-ae41ba57be03?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/8b0e0f22-de42-4da9-a0c1-ae41ba57be03?source=cve)

## Related threats

- [Brainstorm Force SureForms broken access control](https://junglewise.ai/threats/cve-2026-125763-missing-authorization-vulnerability-in-brainstorm-force)
- [Brainstorm Force SureForms broken access control](https://junglewise.ai/threats/cve-2026-120842-missing-authorization-vulnerability-in-brainstorm-force)
- [Brainstorm Force SureForms broken access control vulnerability](https://junglewise.ai/threats/cve-2026-116387-missing-authorization-vulnerability-in-brainstorm-force)
- [Brainstorm Force SureForms content injection via XSS](https://junglewise.ai/threats/cve-2026-116402-improper-neutralization-of-script-related-html-tags-in-a-web)
- [Brainstorm Force SureForms stored cross-site scripting](https://junglewise.ai/threats/cve-2026-108495-improper-neutralization-of-input-during-web-page-generation)