Metform Pro EUVD-2026-22851

The CVSS 5.3 score reflects a network-based attack (AV:N) with low complexity (AC:L) requiring no authentication (PR:N) or user interaction (UI:N). The integrity impact (I:L) is rated as low rather than high because the vulnerability affects the integrity of payment data rather than broader system integrity. However, real-world risk is substantially higher than the moderate CVSS rating suggests. This is a direct financial fraud vector affecting e-commerce workflows: attackers can reduce invoice amounts, avoid payment obligations, or manipulate refund values. The lack of authentication requirement and trivial attack complexity mean any visitor to a vulnerable form can exploit this. EPSS and KEV status are not provided, but the absence of reported active exploitation at analysis time does not diminish priority-payment fraud vulnerabilities are immediately valuable to attackers and likely to be exploited opportunistically. The SSVC framework would rank this as 'Immediate' due to automatable exploitation of a form-handling function affecting multiple payment platforms. For organizations relying on MetForm Pro for transactions, this warrants urgent patching despite the moderate CVSS.

An attacker identifies a WordPress site using MetForm Pro with a product purchase form configured to accept Stripe payments. The form includes a price field calculated based on product selection. The attacker intercepts or crafts a direct REST API request to the form endpoint with a malicious 'mf-calculation' value set to '0.01' instead of the legitimate product price (e.g., '99.99'). The form submission processes successfully, and Stripe charges the victim's payment method only $0.01 instead of the full amount, while the attacker receives the product or service.