CVE-2026-15288 Overview
CVE-2026-15288 affects the SureForms – Drag and Drop Form Builder plugin for WordPress in all versions up to and including 2.2.1. The plugin accepts the payment amount directly from user-controlled POST data in the create_payment_intent and create_subscription_intent functions. It fails to validate the submitted amount against the form's configured price. Unauthenticated attackers can modify the payment amount to any arbitrary value when submitting a Stripe payment form. This allows purchasing products or services at significantly reduced prices. The vulnerability is classified under [CWE-20] Improper Input Validation.
Critical Impact
Unauthenticated attackers can tamper with Stripe payment amounts, enabling fraudulent transactions and direct revenue loss on affected WordPress sites.
Affected Products
- SureForms – Drag and Drop Form Builder for WordPress (all versions ≤ 2.2.1)
- WordPress sites using SureForms with Stripe payment integration enabled
- Fixed in SureForms version 2.2.2
Discovery Timeline
- 2026-07-10 - CVE-2026-15288 published to NVD
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-15288
Vulnerability Analysis
SureForms integrates Stripe payments through the create_payment_intent and create_subscription_intent functions located in the plugin's payments module. Both functions read the payment amount from client-supplied POST data. Neither function reconciles the submitted amount against the price stored in the form configuration on the server. As a result, an attacker intercepting or crafting the payment request can substitute the intended amount with an arbitrary value. Stripe then creates a PaymentIntent or Subscription for the manipulated amount, and the transaction completes successfully at the attacker-controlled price. Because the endpoints are reachable without authentication, exploitation requires only the ability to submit the public form. Refer to the Wordfence Vulnerability Report for additional analysis.
Root Cause
The root cause is trust in client-supplied data. The plugin treats the amount field in the incoming POST body as authoritative rather than deriving the amount from the form's server-side configuration. Server-side price lookup and comparison logic is absent from both intent-creation functions in vulnerable releases.
Attack Vector
An unauthenticated attacker submits a normal Stripe payment form on a WordPress site running SureForms. Before the request reaches the server, the attacker modifies the amount parameter in the POST body using a browser proxy or crafted HTTP request. The plugin forwards the manipulated amount to Stripe when creating the PaymentIntent or Subscription. The order completes for the reduced amount, giving the attacker paid access to the product or service at their chosen price. Review the SureForms front-end changeset and the payment-helper changeset for the corrective code paths.
Detection Methods for CVE-2026-15288
Indicators of Compromise
- Stripe PaymentIntent or Subscription records with amounts that do not match any configured SureForms product price
- HTTP POST requests to SureForms payment endpoints where the amount parameter differs from the form's displayed price
- Successful orders in WordPress with anomalously low totals correlated with SureForms submissions
- Multiple low-value transactions from the same IP or user agent targeting the same paid form
Detection Strategies
- Query Stripe transaction logs and compare amount values against the server-side price for each associated SureForms form ID
- Enable WordPress access logging and inspect POST bodies to the SureForms payment routes for tampered amount fields
- Alert on any SureForms plugin version at or below 2.2.1 discovered by asset inventory or WordPress site scanners
Monitoring Recommendations
- Reconcile Stripe settlement reports against expected product prices on a scheduled basis
- Monitor web application firewall (WAF) logs for POST requests to /wp-json/ or admin-ajax endpoints associated with SureForms payment intent creation
- Track plugin version drift across WordPress estates and flag hosts still running SureForms ≤ 2.2.1
How to Mitigate CVE-2026-15288
Immediate Actions Required
- Upgrade SureForms to version 2.2.2 or later on every affected WordPress site
- Review Stripe transaction history for anomalous payment amounts associated with SureForms submissions since the plugin was installed
- Issue refunds or void fraudulent orders identified during reconciliation and notify affected merchants
- Rotate Stripe API keys if evidence of large-scale abuse is found
Patch Information
The vendor addressed the issue in SureForms 2.2.2. The fix introduces server-side validation of the payment amount against the form's configured price in both the create_payment_intent and create_subscription_intent functions. Technical details are available in the front-end.php changeset and the payment-helper.php changeset.
Workarounds
- Temporarily disable Stripe payment forms built with SureForms until the plugin is upgraded to 2.2.2
- Deploy a WAF rule that blocks or logs POST requests to SureForms payment endpoints containing an amount field, pending patch deployment
- Restrict access to paid SureForms pages via authentication or IP allow-listing where operationally feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
