What is the CVSS score of CVE-2026-2890?

CVE-2026-2890 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-2890?

A critical payment processing vulnerability in Formidable Forms allows attackers to bypass payment validation and mark transactions as complete without actually charging the correct amount, directly…

How to fix or mitigate CVE-2026-2890?

Within 24 hours: Disable Stripe Link payment processing in Formidable Forms settings and switch to alternative payment methods; audit recent transactions for suspicious payment amount discrepancies. Within 7 days: Implement WAF rules to block abnormal Stripe webhook patterns; conduct forensic analysis of payment logs from plugin deployment date to identify compromised transactions. Within 30 days: Migrate payment processing to a dedicated, hardened payment gateway outside WordPress; evaluate plugin replacement or wait for vendor patch availability.

WordPress CVE-2026-2890

EUVD-2026-11756 HIGH

Missing Authorization (CWE-862)

2026-03-13 Wordfence

Authentication Bypass WordPress

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 13, 2026 - 07:58 euvd

EUVD-2026-11756

Analysis Generated

Mar 13, 2026 - 07:58 vuln.today

CVE Published

Mar 13, 2026 - 07:23 nvd

HIGH 7.5

DescriptionCVE.org

The Formidable Forms plugin for WordPress is vulnerable to a payment integrity bypass in all versions up to, and including, 6.28. This is due to the Stripe Link return handler (handle_one_time_stripe_link_return_url) marking payment records as complete based solely on the Stripe PaymentIntent status without comparing the intent's charged amount against the expected payment amount, and the verify_intent() function validating only client secret ownership without binding intents to specific forms or actions. This makes it possible for unauthenticated attackers to reuse a PaymentIntent from a completed low-value payment to mark a high-value payment as complete, effectively bypassing payment for goods or services.

AnalysisAI

High severity vulnerability in Formidable Forms (WordPress plugin). The Formidable Forms plugin for WordPress is vulnerable to a payment integrity bypass in all versions up to, and including, 6.28. This is due to the Stripe Link return handler (handle_one_time_stripe_link_return_url) marking payment records as complete based solely on the Stripe PaymentIntent status without comparing the intent's charged amount against the expected payment amount, and the `ve...

Technical ContextAI

Vulnerability Type: Missing Authorization (CWE-862) CVSS 3.1: 7.5/10.0 — Attack Vector: Network | Complexity: Low | Privileges Required: None | User Interaction: None Attack Techniques: Authentication Bypass Source: Wordfence Authentication bypass allows attackers to access protected resources without valid credentials.

RemediationAI

Monitor Wordfence for patches and updates. Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/ebb4bc5a-9469-4733-acf3-d2dda5edb7af?source=cve