CVE-2026-15288
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The SureForms plugin for WordPress up to version 2.2.1 has an improper input validation vulnerability. The 'create_payment_intent' and 'create_subscription_intent' functions accept payment amounts directly from POST data without validating against the form's configured price, allowing unauthenticated attackers to modify the payment amount.
Risk Assessment
The organization faces financial losses as attackers can purchase products or services at significantly reduced prices by manipulating the payment amount in Stripe forms.
Recommendation
Immediately update the SureForms plugin to the latest available version that includes a fix for payment amount validation.
Other vulnerabilities in SureForms
See all- CVE-2026-19500High
The Entries component in Brainstorm Force SureForms versions less than 2.12.3 does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, allowing a remote attacker to exhaust server resources, prevent administrators from accessing the Entries interface, and trigger HTTP 500 errors via crafted form submissions.
- CVE-2026-7623Medium
The SureForms plugin for WordPress up to version 2.8.1 has a Stored Cross-Site Scripting vulnerability via the 'headingWrapper' parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary scripts.
- CVE-2026-11567Medium
The SureForms WordPress plugin before version 2.11.1 does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amount, allowing unauthenticated users to underpay for the configured product or subscription. Forms using a fixed configured price are not affected.
Original NVD description (English source)
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 2.2.1. This is due to the plugin accepting the payment amount directly from user-controlled POST data in the 'create_payment_intent' and 'create_subscription_intent' functions without validating it against the form's configured price. This makes it possible for unauthenticated attackers to modify the payment amount to any arbitrary value when submitting a Stripe payment form, potentially purchasing products or services at significantly reduced prices.