CVE-2025-3479 Overview
CVE-2025-3479 affects the Forminator Forms plugin for WordPress, a contact, payment, and custom form builder maintained by WPMU DEV. The vulnerability exists in all versions up to and including 1.42.0. The handle_stripe_single function performs insufficient validation on a user-controlled key, allowing an attacker to replay Stripe PaymentIntent identifiers across multiple submissions. Only the first submission produces a real Stripe charge, but the plugin dispatches success emails for every replayed request. This can mislead administrators into fulfilling orders that were never paid for, classifying the issue under improper validation of integrity check value [CWE-354].
Critical Impact
Unauthenticated attackers can replay a single valid Stripe payment to submit multiple fraudulent orders that appear paid to site operators.
Affected Products
- WPMU DEV Forminator Forms plugin for WordPress (free edition)
- All versions up to and including 1.42.0
- Sites using the plugin's Stripe single payment integration
Discovery Timeline
- 2025-04-17 - CVE-2025-3479 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-3479
Vulnerability Analysis
The defect resides in the handle_stripe_single function within library/modules/custom-forms/front/front-action.php. Forminator accepts a payment identifier submitted by the client and treats it as authoritative without validating that the PaymentIntent has not previously been consumed by another form submission. Because the plugin does not bind the PaymentIntent to a single form entry or track prior use, the same identifier can be replayed. Stripe only processes the initial charge, so subsequent replays never generate additional revenue. However, the plugin continues to fire the standard success workflow, including confirmation emails to the site administrator. This is a business logic error rather than a code execution or memory safety flaw.
Root Cause
The root cause is missing integrity validation on a client-controlled Stripe PaymentIntent identifier. The plugin trusts the reused key without checking Stripe for actual charge status or tracking previously processed intents server-side.
Attack Vector
An unauthenticated remote attacker submits the form once with a valid Stripe payment, then replays the same request or PaymentIntent identifier against the WordPress endpoint. The plugin generates a successful email notification for each replay, prompting fulfillment of unpaid orders.
See the WordPress Custom Forms Code and the Wordfence Vulnerability Report for technical details.
Detection Methods for CVE-2025-3479
Indicators of Compromise
- Multiple Forminator form submissions referencing the same Stripe PaymentIntent identifier within a short time window
- Order confirmation emails that do not correspond to charges visible in the Stripe dashboard
- Repeated POST requests to admin-ajax.php or the Forminator submission endpoint from the same client with identical payment tokens
Detection Strategies
- Reconcile every Forminator success email against the authoritative Stripe charge ledger before fulfillment
- Enable and review Forminator submission logs for duplicated payment identifiers across separate entries
- Instrument the WordPress web tier to log request bodies for the Stripe single-payment handler and alert on repeated PaymentIntent values
Monitoring Recommendations
- Monitor Stripe webhook activity for a mismatch between payment_intent.succeeded events and internal order counts
- Track outbound administrator notification volume for anomalous spikes tied to individual form IDs
- Alert on unauthenticated form submissions originating from the same IP or user agent that reuse payment metadata
How to Mitigate CVE-2025-3479
Immediate Actions Required
- Update Forminator Forms to a version above 1.42.0 that includes the fix from WordPress Changeset #3274844
- Audit recent orders against Stripe charge records and cancel fulfillment for any unmatched confirmations
- Restrict order fulfillment workflows to require verification of the underlying Stripe charge, not the plugin email alone
Patch Information
WPMU DEV addressed the flaw in the Forminator plugin repository via WordPress Changeset #3274844. Site administrators should apply the update through the WordPress plugin manager and confirm the installed version is later than 1.42.0.
Workarounds
- Disable the Stripe single payment field in Forminator forms until the patch is applied
- Require manual reconciliation with the Stripe dashboard before any order is marked as fulfilled
- Place the site behind a web application firewall rule that flags duplicate PaymentIntent identifiers submitted to the Forminator endpoint
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
