Wordpress Plugin CVE-2026-2888

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates network-accessible attack vector, low attack complexity, no privilege requirement, no user interaction, with limited integrity impact and no confidentiality or availability impact. The integrity impact is constrained to payment amount modification rather than system-wide compromise, explaining the 5.3 base score. However, real-world risk is substantially elevated by several factors: (1) the vulnerability is trivially exploitable—requiring only HTTP requests with a publicly visible nonce; (2) the attack is fully automatable against any Formidable Forms + Stripe site; (3) direct financial harm is achievable (payment fraud/undercharge); (4) affected sites are typically e-commerce deployments where transaction integrity is critical. EPSS (Exploitation Probability Scoring System) would likely rank this moderate-to-high (estimated 0.65+) due to automation potential and public exploitability. If KEV (Known Exploited Vulnerability) status indicates active exploitation in the wild, priority escalates significantly. The lack of authentication requirement (PR:N) is the critical distinguishing factor from other payment gateway vulnerabilities—any unauthenticated user on the internet can exploit this without compromising other accounts. SSVC decision framework would classify this as at least SCHEDULED patching priority due to exploitability and high technical impact (financial loss), or potentially IMMEDIATE if exploits are public.

An attacker identifies a WordPress site running Formidable Forms with Stripe payment integration and a form offering dynamic pricing (e.g., quantity × unit price via field shortcodes). The attacker extracts the public nonce value from the page's JavaScript variable frm_stripe_vars.nonce. The attacker then crafts an AJAX request to wp-admin/admin-ajax.php?action=frm_strp_amount, injecting JSON payload that overrides the POST quantity or price field with a reduced value (e.g., changing quantity from 10 to 1). The server processes this request without authentication, recalculates the PaymentIntent amount downward, and returns a malicious PaymentIntent with the reduced amount. The attacker completes Stripe checkout with the lower amount, paying significantly less than the listed price. No proof-of-concept is required—the attack requires only HTTP manipulation and publicly available data, making automated exploitation trivial at scale.