CVE-2026-15288: SureForms WordPress Plugin Stripe Payment Price Bypass Vulnerability

Technical summary

CVE-2026-15288 is an improper input validation vulnerability in the SureForms form builder plugin for WordPress. The vulnerable code exists in the 'create_payment_intent' and 'create_subscription_intent' functions, which process Stripe payment submissions. These functions extract the payment amount directly from user-controlled POST parameters without cross-referencing the configured price stored in the form's backend data. An unauthenticated attacker can modify the POST payload to specify an arbitrary amount, bypassing price controls and allowing price manipulation at the point of transaction creation. The vulnerability is classified under CWE-20 (Improper Input Validation) and carries a CVSS v3.1 score of 7.5 (High severity) with a vector reflecting network-based, low-complexity exploitation requiring no privileges or user interaction.

Business impact

This vulnerability directly threatens the revenue and financial integrity of any WordPress site using SureForms to collect Stripe payments. Attackers can systematically reduce or eliminate payment amounts, resulting in immediate financial loss on every compromised transaction. For e-commerce operations, this can translate to substantial revenue leakage if exploited at scale. Beyond direct losses, incident response, forensic investigation, and potential notification obligations to payment networks add operational costs. Customer trust is also at risk if fraudulent or zero-value transactions appear on statements. Sites relying on SureForms for subscriptions face the added complexity of recurring billing abuse.

Affected systems

The vulnerability affects the SureForms – Drag and Drop Form Builder for WordPress plugin in all versions up to and including version 2.2.1. Any WordPress installation running this plugin version range with Stripe payment forms is vulnerable. The vulnerability is unauthenticated, meaning no special account access is required to exploit it—any visitor to a form can attempt the attack. Exposure depends on whether the affected site has publicly accessible payment forms and whether those forms are actively used.

Exploitability

This vulnerability is trivial to exploit. An attacker only needs to submit a payment form on an affected WordPress site while intercepting the HTTP POST request (using browser developer tools, a proxy, or a simple script) and modify the amount field before it reaches the Stripe API. No special tools, authentication, or user interaction tricks are required. The attack is reliably reproducible and can be automated. The CVSS vector confirms this: network-accessible, no privileges needed, no user interaction required, and low attack complexity. No patch from the KEV Catalog has been assigned, indicating active in-the-wild exploitation has not yet been tracked by CISA, but the ease of exploitation means vulnerability windows should be kept short.

Remediation

Update the SureForms plugin immediately to a version that implements server-side price validation. When patched versions become available, the plugin should retrieve the configured form price from the WordPress database and compare it against any incoming payment request before passing it to Stripe. No interim workarounds fully mitigate the flaw—disabling Stripe integration stops the bleeding but eliminates payment functionality. As a temporary measure while awaiting patches, consider restricting access to payment forms to authenticated users only or moving to a different form plugin with proper payment controls.

Patch guidance

Check the SureForms plugin repository and the vendor's advisory for patched versions beyond 2.2.1. Once a patched version is released, apply it through the WordPress admin dashboard (Plugins → Installed Plugins → Update). Verify the update completes successfully and test a non-production Stripe transaction to confirm the payment amount is now locked to the configured form price and cannot be modified from the client side. Keep the plugin updated regularly going forward, as input validation oversights are common in form-builder tools.

Detection guidance

Monitor Stripe webhook logs and transaction records for anomalous payment amounts that deviate significantly from configured product prices or show patterns of reduced charges. Search WordPress error logs for repeated failures in the 'create_payment_intent' function, which may indicate automated attack attempts. Review server access logs for POST requests to your form handler endpoints with unusual parameters or frequency spikes. Consider enabling Stripe's fraud detection and velocity checks. Audit your form configurations to confirm prices are not being overridden by POST parameters in the plugin code. A security audit of the plugin's payment handling functions is advisable.

Why prioritize this

This vulnerability merits immediate attention due to its combination of high severity (CVSS 7.5), trivial exploitability, complete lack of authentication barriers, and direct financial impact. Any e-commerce or subscription site running the affected plugin is immediately exposed to revenue loss. Unlike vulnerabilities requiring multi-step exploitation or specific configurations, this flaw is present and attackable in default deployments. The three-day gap between discovery (July 10) and last modification (July 14) suggests rapid patch development; prioritize checking for and deploying fixes as soon as they are released.

Risk score, explained

The CVSS v3.1 score of 7.5 reflects a High-severity vulnerability with network-based attack vector, low complexity, no privilege requirement, and no user interaction needed. However, the score does not fully capture business context: the integrity impact is rated as 'High' (correct, given the ability to manipulate prices) and availability and confidentiality impacts are 'None' (also correct). The severity is anchored on the ease and reliability of exploitation combined with direct financial harm. For a payment-handling plugin, this score is appropriate and warrants emergency response.

Frequently asked questions