What is the CVSS score of CVE-2026-2888?

CVE-2026-2888 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-2888?

Organizations using for WordPress is vulnerable to an authorization bypass should be aware of moderate risk from CVE-2026-2888, a IDOR vulnerability rated CVSS 5.3.

How to fix or mitigate CVE-2026-2888?

Within 30 days: Identify affected systems running for WordPress is vulnerable to an authorization bypass and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-2888

EUVD-2026-11766 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-13 Wordfence

Authentication Bypass WordPress CSRF

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 09:00 euvd

EUVD-2026-11766

Analysis Generated

Mar 13, 2026 - 09:00 vuln.today

CVE Published

Mar 13, 2026 - 08:25 nvd

MEDIUM 5.3

DescriptionCVE.org

The Formidable Forms plugin for WordPress is vulnerable to an authorization bypass through user-controlled key in all versions up to, and including, 6.28. This is due to the frm_strp_amount AJAX handler (update_intent_ajax) overwriting the global $_POST data with attacker-controlled JSON input and then using those values to recalculate payment amounts via field shortcode resolution in generate_false_entry(). The handler relies on a nonce that is publicly exposed in the page's JavaScript (frm_stripe_vars.nonce), which provides CSRF protection but not authorization. This makes it possible for unauthenticated attackers to manipulate PaymentIntent amounts before payment completion on forms using dynamic pricing with field shortcodes, effectively paying a reduced amount for goods or services.

AnalysisAI

The Formidable Forms WordPress plugin versions up to 6.28 contain an authorization bypass vulnerability in the Stripe payment integration that allows unauthenticated attackers to manipulate PaymentIntent amounts before payment completion. An attacker can exploit the publicly exposed nonce in the frm_strp_amount AJAX handler to overwrite POST data and recalculate dynamic pricing fields, enabling payment of reduced amounts for goods or services. While the CVSS score is moderate at 5.3, the vulnerability has direct financial impact on e-commerce deployments and poses a meaningful risk to sites using dynamic pricing with Formidable Forms and Stripe.

Technical ContextAI

The vulnerability resides in the Formidable Forms plugin's Stripe integration, specifically in the frm_strp_amount AJAX handler and its update_intent_ajax() function. The root cause is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), a fundamental authorization flaw where attacker-controlled input is used to determine access or modify protected operations. The vulnerable code accepts JSON input from unauthenticated requests, overwrites the global PHP $_POST superglobal with attacker data, and then processes field shortcode resolution via generate_false_entry() to recalculate Stripe PaymentIntent amounts. While the endpoint is protected by a WordPress nonce (frm_stripe_vars.nonce), this nonce only provides CSRF mitigation and does not enforce user authentication or authorization checks. The nonce value is publicly exposed in page JavaScript, making it trivial for attackers to obtain. The integration relies on WooCommerce Stripe gateway or Stripe API version 2019-12-03 or later (typical Formidable Forms configurations), and the vulnerability affects all plugin versions distributed via WordPress.org plugin repository (CPE: cpe:2.3:a:strategy11:formidable:*:*:*:*:*:wordpress:*:*).

RemediationAI

Immediately upgrade Formidable Forms to version 6.29 or later, which contains authorization checks and proper server-side validation of payment amounts. This is the primary mitigation and should be prioritized as critical. Until patching is completed, implement the following compensating controls: (1) Disable Stripe integration or the dynamic pricing feature in Formidable Forms settings if not strictly necessary; (2) Implement Web Application Firewall (WAF) rules blocking POST requests to the wp-admin/admin-ajax.php?action=frm_strp_amount endpoint from non-authenticated users, or rate-limit these requests aggressively; (3) Monitor Stripe webhooks and payment logs for anomalies, including PaymentIntent amounts that differ from form field calculations, and flag or block suspicious transactions; (4) Review recent Stripe transactions for evidence of exploitation (reduced payment amounts inconsistent with form configuration). Consult the official Formidable Forms security advisory and WP Engine/plugin documentation for version-specific patch release notes and any additional post-upgrade validation steps.