What is the CVSS score of CVE-2026-4987?

CVE-2026-4987 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-4987?

SureForms WordPress plugin versions 2.5.2 and earlier contain a payment amount bypass vulnerability allowing unauthenticated attackers to manipulate transaction values, creating significant fraud…

How to fix or mitigate CVE-2026-4987?

Within 24 hours: disable the SureForms plugin or restrict form access to authenticated users only; audit payment transaction logs for anomalies since plugin installation. Within 7 days: contact Brainstorm Force for patch availability timeline; if no patch emerges, evaluate plugin alternatives or implement Web Application Firewall rules to block form_id parameter manipulation. Within 30 days: migrate to a patched version upon release or replace the plugin entirely; conduct forensic review of all payment records created while vulnerable.

WordPress CVE-2026-4987

EUVD-2026-16905 HIGH

Improper Input Validation (CWE-20)

2026-03-28 Wordfence

GHSA-v8h4-7xcp-85r6

WordPress Authentication Bypass

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 28, 2026 - 01:30 euvd

EUVD-2026-16905

Analysis Generated

Mar 28, 2026 - 01:30 vuln.today

CVE Published

Mar 28, 2026 - 01:25 nvd

HIGH 7.5

DescriptionCVE.org

The SureForms - Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Payment Amount Bypass in all versions up to, and including, 2.5.2. This is due to the create_payment_intent() function performing a payment validation solely based on the value of a user-controlled parameter. This makes it possible for unauthenticated attackers to bypass configured form payment-amount validation and create underpriced payment/subscription intents by setting form_id to 0.

AnalysisAI

Payment amount bypass in Brainstorm Force SureForms WordPress plugin (all versions ≤2.5.2) allows unauthenticated remote attackers to create underpriced payment and subscription intents by manipulating the form_id parameter to 0, circumventing configured payment validation. CVSS 7.5 (High) with network-accessible attack vector and low complexity. EPSS data not provided; no public exploit identified at time of analysis. This represents a direct financial fraud risk for e-commerce and donation sites using the affected plugin.

Technical ContextAI

SureForms is a WordPress form builder plugin by Brainstorm Force that supports payment processing integrations (likely Stripe/PayPal based on payment intent terminology). The vulnerability resides in the create_payment_intent() function, which performs payment amount validation based on a user-controlled form_id parameter without proper server-side verification. CWE-20 (Improper Input Validation) indicates the root cause: the application trusts client-supplied data to determine payment amounts. By setting form_id to 0, attackers bypass the legitimate form configuration that specifies correct pricing, allowing the creation of payment intents with arbitrary amounts. This affects the WordPress plugin identified by CPE cpe:2.3:a:brainstormforce:sureforms_-_contact_form,_payment_form_&_other_custom_form_builder, specifically versions up to and including 2.5.2. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is a network-based attack requiring no authentication, no user interaction, and low attack complexity.

RemediationAI

Upstream fix available via WordPress plugin repository commit 3488858 visible at https://plugins.trac.wordpress.org/changeset/3488858/sureforms, indicating server-side validation has been implemented. Site administrators should immediately update SureForms to the latest version (post-2.5.2) through the WordPress admin dashboard (Plugins > Updates) or manually via the official WordPress plugin repository. Verify the installed version exceeds 2.5.2 after update. As interim mitigation if patching is delayed, consider temporarily disabling payment functionality in SureForms forms or deactivating the plugin entirely until update is applied, then audit recent payment transactions for anomalies (payments below expected amounts). Review payment gateway logs for suspicious form_id=0 submissions. No configuration-based workaround exists due to the server-side validation flaw. Consult the Wordfence advisory for additional technical details to inform incident response if exploitation is suspected.