What is the CVSS score of CVE-2026-15288?

CVE-2026-15288 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of SureForms are affected by CVE-2026-15288?

The SureForms WordPress plugin (versions ≤ 2.2.1) contains a payment tampering vulnerability allowing unauthenticated users to modify purchase amounts during Stripe checkout, enabling fraudulent…

How to fix or mitigate CVE-2026-15288?

Within 24 hours: Inventory all WordPress installations using SureForms plugin and identify current versions; disable checkout functionality if running version 2.2.1 or earlier and unable to patch immediately. Within 7 days: Update all affected SureForms installations to version 2.2.2 or later. Within 30 days: Audit Stripe transaction logs from the preceding 90 days for anomalous payment amounts significantly below expected product prices; investigate all fractional-cost transactions for fraudulent activity and quantify potential revenue impact.

SureForms CVE-2026-15288

EUVD-2026-42797 HIGH

Improper Input Validation (CWE-20)

2026-07-10 security@wordfence.com

GHSA-6vjw-3rm9-r84x

WordPress Information Disclosure

7.5

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

5.3 MEDIUM

Remote unauthenticated tampering of a single request field (AV:N/AC:L/PR:N/UI:N); impact is limited to transaction/price integrity with no data or availability effect, so I:L, C:N, A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 05:31 vuln.today

CVE Published

Jul 10, 2026 - 05:16 nvd

HIGH 7.5

DescriptionCVE.org

The SureForms - Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 2.2.1. This is due to the plugin accepting the payment amount directly from user-controlled POST data in the 'create_payment_intent' and 'create_subscription_intent' functions without validating it against the form's configured price. This makes it possible for unauthenticated attackers to modify the payment amount to any arbitrary value when submitting a Stripe payment form, potentially purchasing products or services at significantly reduced prices.

AnalysisAI

Payment amount tampering in the SureForms WordPress plugin (versions ≤ 2.2.1) lets unauthenticated attackers submit arbitrary prices when completing Stripe checkout. Because the 'create_payment_intent' and 'create_subscription_intent' handlers trust the amount supplied in user-controlled POST data instead of the form's server-side configured price, an attacker can purchase products or subscriptions for a fraction of their real cost. Reported by Wordfence and fixed in 2.2.2; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

SureForms is a drag-and-drop form builder for WordPress that integrates Stripe to collect one-time and recurring payments. The flaw is a classic CWE-20 (Improper Input Validation) business-logic failure: when the front end requests a Stripe PaymentIntent or SubscriptionIntent, the server-side PHP (inc/payments/front-end.php and payment-helper.php) reads the charge amount straight from the client request rather than recomputing it from the form's stored price configuration. Stripe faithfully charges whatever amount the merchant's backend tells it to, so the authoritative price must be enforced on the WordPress side - which this code fails to do, allowing the client to dictate the transaction value.

RemediationAI

Vendor-released patch: update SureForms to version 2.2.2 or later, which enforces the server-side configured price when creating Stripe payment and subscription intents (see WordPress changeset 3427656 at https://plugins.trac.wordpress.org/changeset/3427656/sureforms/ and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/8b0e0f22-de42-4da9-a0c1-ae41ba57be03). If you cannot upgrade immediately, disable or unpublish any SureForms forms that accept Stripe payments to remove the exploitable endpoints (trade-off: this halts online sales through those forms). As a detective control, reconcile Stripe dashboard charge amounts against expected product prices and set up Stripe Radar or webhook alerts for underpriced or anomalous PaymentIntents so tampered transactions can be flagged, refunded, and fulfillment withheld until the patch is applied.