Security Alert Summary
The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress contains a payment amount bypass vulnerability (CVE-2026-4987) in all versions up to and including 2.5.2. The issue allows unauthenticated attackers to create underpriced payment or subscription intents because a payment validation step trusts a user-controlled parameter.
CVE Details
- CVE ID: CVE-2026-4987
- Affected component: SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress
- Affected versions: All versions up to, and including, 2.5.2
- Published: March 28, 2026 at 2:16:14 AM (UTC)
- Last modified: March 28, 2026 at 2:16:14 AM (UTC)
- CVSS v3.1: Base Score 7.5, Severity HIGH, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Authentication requirements: None (unauthenticated)
- Privileges required: None
- User interaction: None
- Primary impact: Confidentiality: NONE; Integrity: HIGH; Availability: NONE
- Weakness (CWE): CWE-20
Technical Details
The vulnerability is a payment amount bypass. The plugin’s create_payment_intent() function performs payment validation solely based on the value of a user-controlled parameter. An attacker can set the form_id parameter to 0 to bypass configured form payment-amount validation and create underpriced payment or subscription intents. Because the validation relies on input that can be controlled by the requester, the integrity of payment amounts can be violated without authentication.
How This Could Impact Your Website
Consider a site that uses SureForms to accept one-time payments or subscriptions. A site owner publishes payment forms, internal staff manage form settings, and an external contractor helps with payment reconciliation. An unauthenticated attacker could submit the payment flow with form_id set to 0 and cause underpriced payment or subscription intents. Practical consequences include lost revenue, billing and reconciliation discrepancies, subscription records that do not match actual payments, and customer support burden resolving incorrect charges or access.
This issue impacts the integrity of payment amounts rather than exposing confidential data. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other low-privilege accounts that can submit forms.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins handling payments or sensitive workflows.
- Monitor site activity and payment logs for unusual behavior or unexpected low-value payment intents.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
