What is the CVSS score of CVE-2026-11567?

CVE-2026-11567 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-11567?

Yes, a public proof-of-concept exploit is available for CVE-2026-11567. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-11567?

Yes, a patch is available for CVE-2026-11567. Update the affected software to the latest version immediately.

SureForms CVE-2026-11567

EUVD-2026-43625 MEDIUM

2026-07-14 WPScan

GHSA-9r96-r77r-wwjr

WordPress Information Disclosure Sureforms

5.9

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

5.9 MEDIUM

Network-accessible form requires no authentication; AC:H because exploitation requires a variable-priced form configuration and precise parameter interception; integrity impact only - no confidentiality or availability consequence.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 13:24 vuln.today

CVSS changed

Jul 14, 2026 - 13:22 NVD

5.9 (MEDIUM)

Patch available

Jul 14, 2026 - 11:17 EUVD

CVE Published

Jul 14, 2026 - 06:00 cve.org

MEDIUM 5.9

CVE Published

Jul 14, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The SureForms WordPress plugin before 2.11.1 does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amount, allowing unauthenticated users to underpay for the configured product or subscription. Forms using a fixed configured price are not affected.

AnalysisAI

SureForms WordPress plugin before 2.11.1 permits unauthenticated attackers to submit manipulated payment amounts below the configured price on any form using a dynamically-sourced or hidden variable payment field, enabling financial fraud against site operators. The integrity bypass is confined to forms with variable pricing; fixed-price forms are explicitly unaffected. A publicly available proof-of-concept exists via WPScan, and a vendor patch is available in version 2.11.1 - though no CISA KEV listing confirms active mass exploitation at time of analysis.

Technical ContextAI

SureForms is a WordPress form-builder plugin that supports payment integrations where the payment amount can be either fixed (hard-coded server-side) or dynamically sourced from variable or hidden client-supplied fields. The root cause is the absence of server-side validation that reconciles the submitted payment amount against a minimum or expected price configured by the site administrator. When the amount originates from a hidden or variable HTML form field, the server trusts the client-supplied value without enforcing a floor. No CWE was formally assigned, but this aligns with CWE-20 (Improper Input Validation) and CWE-345 (Insufficient Verification of Data Authenticity) - the server fails to authenticate that the submitted amount meets the operator-configured threshold. CPE data identifies the affected package as cpe:2.3:a:unknown:sureforms:*:*:*:*:*:*:*:*, with the vendor field unresolved in the NVD CPE registry.

RemediationAI

Upgrade SureForms to version 2.11.1 or later, which introduces proper server-side validation of submitted payment amounts against configured price thresholds. This is the only confirmed fix; the vendor patch is available and should be applied immediately on any site accepting payments via dynamic or variable amount forms. As a compensating control prior to patching, administrators should convert all payment forms to use a fixed configured price, which eliminates the vulnerable code path entirely - note this may break legitimate variable-pricing use cases such as custom amount donations or tiered subscriptions and will require form reconfiguration. Alternatively, disabling payment functionality on the affected forms until patching is feasible is the safest interim measure. The WPScan advisory at https://wpscan.com/vulnerability/bd738da7-f950-4da9-bcc1-c1fe845d7faa/ should be monitored for additional guidance.