SureForms EUVD-2026-43625

Exploitation requires three concurrent conditions: the target WordPress site must be running SureForms prior to version 2.11.1; at least one payment form must be configured to use a dynamically-sourced or variable/hidden payment amount field (not a fixed price); and the attacker must be able to reach and submit that form (no authentication required, PR:N). The attacker must also possess a payment method accepted by the site's configured payment gateway, which is a meaningful practical barrier - they must spend at least a minimal real-money amount to complete the transaction. Exploitation is limited by AC:H, indicating the attacker must identify the correct manipulable parameter in the form submission, which requires intercepting the HTTP request. Fixed-price forms are explicitly out of scope and cannot be exploited via this vector.

The CVSS 3.1 base score of 5.9 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N reflects a network-exploitable, unauthenticated flaw with high integrity impact but no confidentiality or availability impact. AC:H captures a genuine complexity barrier: the attacker must identify a site using SureForms with variable-priced forms and correctly identify the manipulable parameter. No EPSS score was provided, so probabilistic exploitation rates cannot be quantified. The publicly available POC via WPScan meaningfully lowers the skill bar for motivated actors, raising practical risk above what the CVSS medium score alone implies. The absence of a CISA KEV listing means confirmed active exploitation is not established. Real-world business impact is concrete - financial loss from underpaid transactions - but is bounded to sites actively using variable-amount payment forms. Fixed-price form deployments are entirely unaffected, narrowing the vulnerable population. The combination of a public POC, no authentication requirement, and direct financial impact makes this a genuine priority for any operator running SureForms payment forms with dynamic pricing.

An attacker discovers a WordPress site running SureForms before 2.11.1 with a subscription form that sources the payment amount from a hidden or variable field. Using a browser proxy such as Burp Suite, the attacker intercepts the form submission and modifies the payment amount parameter to an arbitrarily low value (e.g., $0.01) before forwarding the request. Because the server does not validate the submitted amount against the configured price, the payment gateway processes the manipulated amount, and the attacker gains access to the product or subscription at a fraction of its intended cost. A public POC is documented in the WPScan advisory.