Security Alert Summary
The MetForm Pro plugin for WordPress contains an improper input validation vulnerability that can allow an attacker to manipulate payment amounts. The issue involves payment integrations (Stripe/PayPal) trusting a user-submitted calculation field value instead of recomputing or validating it against the configured form price. An attacker can modify the mf-calculation field in the form submission REST request when a specific form configuration is present.
CVE Details
- CVE ID: CVE-2026-1782
- Affected component: MetForm Pro plugin for WordPress
- Affected versions: All versions up to and including 3.9.7
- Published: April 15, 2026 at 9:16:31 AM (UTC)
- Last modified: April 15, 2026 at 9:16:31 AM (UTC)
- CVSS v3.1: Base score 5.3 (MEDIUM) — Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Authentication / privileges / user interaction: Attack Vector: NETWORK; Privileges Required: NONE; User Interaction: NONE
- Primary impact: Confidentiality: NONE; Integrity: LOW; Availability: NONE
- Weakness: CWE-20 (Improper Input Validation)
Technical Details
The vulnerability is caused by improper input validation in the plugin’s payment integrations for Stripe and PayPal. When a form is configured to use a calculation field, the integration logic trusts the value supplied in the mf-calculation field of the form submission REST request instead of recomputing or validating that value against the form’s configured price. This design allows an unauthenticated attacker to submit a manipulated mf-calculation value that alters the payment amount processed by the integration, given a specific form configuration exists that relies on that field.
The issue arises from missing or insufficient server-side validation of submitted calculation values before passing them to payment processors. The impact is limited to integrity of payment amounts (for example, processing a lower amount than intended) and does not indicate direct disclosure of confidential data or disruption of availability per the CVSS assessment.
How This Could Impact Your Website
Consider a site that accepts payments via forms built with MetForm Pro. An attacker could craft and submit form data that tampers with the mf-calculation field to alter the amount sent to the payment gateway. In a realistic scenario, an external attacker or malicious contributor could submit manipulated payments that result in underpaid transactions, causing reconciliation issues for the site owner and billing discrepancies for internal staff handling orders and payments.
Practical consequences include incorrectly recorded payments, manual reconciliation overhead for finance staff, and potential chargeback disputes with payment providers. While this vulnerability affects payment integrity, it does not by itself grant broader site access. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other low-privilege accounts that can submit forms.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins that increase your attack surface.
- Monitor site activity and payment records for unusual behavior or reconciliation discrepancies.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
