CVE-2026-1782: MetForm Pro WordPress Auth Bypass Flaw

CVE-2026-1782 Overview

The MetForm Pro plugin for WordPress is vulnerable to Improper Input Validation (CWE-20) in all versions up to and including 3.9.7. This vulnerability exists because the payment integrations (Stripe/PayPal) trust user-submitted calculation field values without recomputing or validating them against the configured form price. This allows unauthenticated attackers to manipulate payment amounts via the mf-calculation field in form submission REST requests, provided a specific form configuration exists.

Critical Impact

Unauthenticated attackers can bypass payment validation to submit forms with manipulated payment amounts, potentially resulting in financial fraud and revenue loss for affected WordPress sites using MetForm Pro with payment integrations.

Affected Products

• MetForm Pro plugin for WordPress versions up to and including 3.9.7
• WordPress sites using MetForm Pro with Stripe payment integration
• WordPress sites using MetForm Pro with PayPal payment integration

Discovery Timeline

• April 15, 2026 - CVE-2026-1782 published to NVD
• April 15, 2026 - Last updated in NVD database

Technical Details for CVE-2026-1782

Vulnerability Analysis

This vulnerability stems from a fundamental trust boundary violation in the MetForm Pro plugin's payment processing workflow. When a user submits a form with payment fields configured, the plugin accepts a client-side calculated value from the mf-calculation field without performing server-side validation against the actual form configuration.

The payment gateway integrations for both Stripe and PayPal rely on this user-controlled value to process transactions. Since the calculation is performed client-side and transmitted to the server without verification, an attacker can intercept and modify the REST API request to substitute an arbitrary payment amount. The server-side code then passes this manipulated value directly to the payment processor, resulting in transactions being processed for incorrect amounts.

This type of input validation vulnerability is particularly dangerous in e-commerce and payment contexts, as it directly enables financial fraud. The attack requires no authentication, making any publicly accessible form with payment functionality a potential target.

Root Cause

The root cause is the absence of server-side price validation in the MetForm Pro payment processing logic. The plugin architecture trusts the mf-calculation field value submitted by the client without:

1. Recomputing the expected price based on form configuration and selected items
2. Validating the submitted amount against minimum or expected price thresholds
3. Cross-referencing the calculation with server-side stored pricing data

This violates the security principle of never trusting client-side input for security-critical operations such as payment processing.

Attack Vector

The attack is executed via the network by intercepting and modifying REST API form submission requests. An unauthenticated attacker targets WordPress installations with MetForm Pro that have payment-enabled forms.

The attack flow involves:

1. Locating a WordPress site with a MetForm Pro form that includes Stripe or PayPal payment integration
2. Intercepting the form submission REST request (typically to the WordPress REST API endpoint)
3. Modifying the mf-calculation field value to a lower amount (potentially zero or minimal value)
4. Submitting the modified request to complete the transaction at the attacker-specified price

The vulnerability is exploitable through standard web request manipulation tools. The attacker can modify the calculation field in the JSON payload of the REST request to any arbitrary value, and the server will process the payment for that manipulated amount without validation.

Detection Methods for CVE-2026-1782

Indicators of Compromise

• Unusual payment amounts that don't match configured product or service prices
• High volume of minimum-amount transactions from the same IP addresses
• Form submissions where the calculated total doesn't match expected values based on selected options
• REST API requests to MetForm endpoints with modified mf-calculation field values

Detection Strategies

• Implement logging and alerting on payment transactions that fall below expected price thresholds
• Monitor MetForm REST API endpoints for unusual request patterns or parameter tampering
• Compare completed payment amounts against form configuration expected values in payment processor dashboards
• Deploy web application firewall (WAF) rules to detect suspicious parameter modifications

Monitoring Recommendations

• Enable detailed logging for all MetForm form submissions with payment processing
• Set up alerts in payment gateway dashboards (Stripe/PayPal) for transactions below expected amounts
• Review server access logs for repeated form submission attempts from single IP addresses
• Correlate form submission logs with actual payment receipts to identify discrepancies

How to Mitigate CVE-2026-1782

Immediate Actions Required

• Update MetForm Pro plugin to a version newer than 3.9.7 when a patch becomes available
• Audit recent payment transactions for anomalous amounts that may indicate exploitation
• Temporarily disable payment-enabled forms if suspicious activity is detected
• Consider implementing additional server-side validation as a compensating control

Patch Information

Organizations should monitor WPMet Plugin Information for security updates and patched versions. For detailed vulnerability information, refer to the Wordfence Vulnerability Report. Apply the patch immediately upon release and verify the update was successful by confirming the plugin version in the WordPress admin dashboard.

Workarounds

• Temporarily disable MetForm Pro payment integrations until a patch is available
• Implement a server-side price validation layer using custom WordPress hooks or middleware
• Use payment gateway-side controls to set minimum transaction amounts matching your lowest priced offering
• Consider alternative form plugins with server-side price calculation for payment-critical workflows

# Configuration example - Temporarily disable MetForm Pro
# Navigate to WordPress plugins directory and deactivate via WP-CLI
wp plugin deactivate metform-pro

# Re-enable only after applying security patch
wp plugin activate metform-pro