Security Alert Summary
The Formidable Forms plugin for WordPress contains an authorization bypass that can allow unauthenticated attackers to manipulate payment amounts on forms using dynamic pricing with field shortcodes. The issue stems from an AJAX handler that accepts attacker-controlled JSON, overwrites $_POST, and uses those values to recalculate PaymentIntent amounts before payment completion.
CVE Details
- CVE ID: CVE-2026-2888
- Affected plugin / component: Formidable Forms plugin for WordPress
- Affected versions: All versions up to and including 6.28
- Published: March 13, 2026 at 7:54:34 PM UTC
- Last modified: March 13, 2026 at 7:54:34 PM UTC
- CVSS v3.1: Base score 5.3 — MEDIUM
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Authentication / Privileges / User interaction: No authentication required;
PR:N; no user interaction required - Primary impact: Confidentiality: None; Integrity: Low; Availability: None
- CWE / weakness: CWE-639
- Fixed version: Not specified in the CVE entry
Technical Details
This vulnerability is an authorization bypass involving the Formidable Forms Stripe integration. The issue is triggered by the frm_strp_amount AJAX handler (also referenced as update_intent_ajax), which accepts JSON input from user-controlled data and overwrites the global $_POST array with that content. After this overwrite, the plugin recalculates payment amounts by resolving field shortcodes via generate_false_entry(), using the attacker-supplied values rather than server-validated data.
The AJAX handler relies on a nonce value exposed in page JavaScript (frm_stripe_vars.nonce). While the nonce provides CSRF protection, the CVE notes that it does not provide authorization, and therefore does not prevent unauthenticated manipulation of the payment amount in this flow. As described, an attacker can alter the PaymentIntent amount before payment completion on forms that use dynamic pricing populated by field shortcodes.
How This Could Impact Your Website
Imagine a site owner running a store or accepting payments via a Formidable form that uses dynamic pricing (field shortcodes). An unauthenticated attacker could manipulate a form submission so the PaymentIntent amount is reduced before the payment is completed. This could result in customers paying less than the intended price, incorrect order fulfillment, accounting discrepancies, and increased risk of chargebacks or disputes.
The vulnerability affects the integrity of payment amounts rather than disclosing user data (Confidentiality: None). However, financial discrepancies and fraudulent transactions can still create operational and reputational issues for site owners, staff, and contractors who manage orders and billing. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available (no fixed version is specified in the CVE entry).
- Review and reduce unnecessary user roles and permissions, especially for contributors who can edit forms or payment-related settings.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins, and audit plugins that handle payments or sensitive business logic.
- Monitor site activity and payment logs for unusual behavior, unexpected price changes, or increased chargebacks.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/formidable/tags/6.28/stripe/controllers/FrmStrpLiteHooksController.php#L88
- https://plugins.trac.wordpress.org/browser/formidable/tags/6.28/stripe/models/FrmStrpLiteAuth.php#L322
- https://plugins.trac.wordpress.org/browser/formidable/tags/6.28/stripe/models/FrmStrpLiteAuth.php#L402
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3480574%40formidable%2Ftrunk&old=3460198%40formidable%2Ftrunk&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b8be3b6e-a035-4e6f-ba2b-ce9e59ebf2e0?source=cve
