EUVD-2026-11766Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Formidable Forms plugin for WordPress is vulnerable to an authorization bypass through user-controlled key in all versions up to, and including, 6.28. This is due to the frm_strp_amount AJAX handler (update_intent_ajax) overwriting the global $_POST data with attacker-controlled JSON input and then using those values to recalculate payment amounts via field shortcode resolution in generate_false_entry(). The handler relies on a nonce that is publicly exposed in the page's JavaScript (frm_stripe_vars.nonce), which provides CSRF protection but not authorization. This makes it possible for unauthenticated attackers to manipulate PaymentIntent amounts before payment completion on forms using dynamic pricing with field shortcodes, effectively paying a reduced amount for goods or services.
AnalysisAI
The Formidable Forms WordPress plugin versions up to 6.28 contain an authorization bypass vulnerability in the Stripe payment integration that allows unauthenticated attackers to manipulate PaymentIntent amounts before payment completion. An attacker can exploit the publicly exposed nonce in the frm_strp_amount AJAX handler to overwrite POST data and recalculate dynamic pricing fields, enabling payment of reduced amounts for goods or services. While the CVSS score is moderate at 5.3, the vulnerability has direct financial impact on e-commerce deployments and poses a meaningful risk to sites using dynamic pricing with Formidable Forms and Stripe.
Technical ContextAI
The vulnerability resides in the Formidable Forms plugin's Stripe integration, specifically in the frm_strp_amount AJAX handler and its update_intent_ajax() function. The root cause is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), a fundamental authorization flaw where attacker-controlled input is used to determine access or modify protected operations. The vulnerable code accepts JSON input from unauthenticated requests, overwrites the global PHP $_POST superglobal with attacker data, and then processes field shortcode resolution via generate_false_entry() to recalculate Stripe PaymentIntent amounts. While the endpoint is protected by a WordPress nonce (frm_stripe_vars.nonce), this nonce only provides CSRF mitigation and does not enforce user authentication or authorization checks. The nonce value is publicly exposed in page JavaScript, making it trivial for attackers to obtain. The integration relies on WooCommerce Stripe gateway or Stripe API version 2019-12-03 or later (typical Formidable Forms configurations), and the vulnerability affects all plugin versions distributed via WordPress.org plugin repository (CPE: cpe:2.3:a:strategy11:formidable:*:*:*:*:*:wordpress:*:*).
RemediationAI
Immediately upgrade Formidable Forms to version 6.29 or later, which contains authorization checks and proper server-side validation of payment amounts. This is the primary mitigation and should be prioritized as critical. Until patching is completed, implement the following compensating controls: (1) Disable Stripe integration or the dynamic pricing feature in Formidable Forms settings if not strictly necessary; (2) Implement Web Application Firewall (WAF) rules blocking POST requests to the wp-admin/admin-ajax.php?action=frm_strp_amount endpoint from non-authenticated users, or rate-limit these requests aggressively; (3) Monitor Stripe webhooks and payment logs for anomalies, including PaymentIntent amounts that differ from form field calculations, and flag or block suspicious transactions; (4) Review recent Stripe transactions for evidence of exploitation (reduced payment amounts inconsistent with form configuration). Consult the official Formidable Forms security advisory and WP Engine/plugin documentation for version-specific patch release notes and any additional post-upgrade validation steps.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today