CVE-2026-2890: Formidable Forms Payment Bypass Vulnerability

CVE-2026-2890 Overview

The Formidable Forms plugin for WordPress contains a critical payment integrity bypass vulnerability in all versions up to and including 6.28. The flaw resides in the Stripe payment handling logic, specifically within the handle_one_time_stripe_link_return_url function and the verify_intent() validation mechanism. This vulnerability allows unauthenticated attackers to reuse a PaymentIntent from a previously completed low-value payment to fraudulently mark a high-value payment as complete, effectively bypassing payment for goods or services.

Critical Impact

Unauthenticated attackers can exploit this payment integrity bypass to obtain goods or services without proper payment by reusing PaymentIntents from low-value transactions to complete high-value purchases.

Affected Products

• Formidable Forms plugin for WordPress versions ≤ 6.28
• WordPress sites using Formidable Forms with Stripe payment integration
• E-commerce and payment forms utilizing Stripe Link functionality

Discovery Timeline

• 2026-03-13 - CVE-2026-2890 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-2890

Vulnerability Analysis

This payment integrity bypass vulnerability (CWE-862: Missing Authorization) stems from insufficient validation in the Stripe payment processing workflow. The vulnerability exploits a fundamental design flaw where the payment completion handler trusts the Stripe PaymentIntent status without performing adequate verification of the transaction context.

The handle_one_time_stripe_link_return_url function marks payment records as complete based solely on whether the Stripe PaymentIntent status indicates success. Critically, it fails to compare the PaymentIntent's charged amount against the expected payment amount for the specific transaction. This creates a disconnect between what was actually charged and what the WordPress site records as paid.

Additionally, the verify_intent() function only validates client secret ownership without binding intents to specific forms or actions. This means an attacker can capture a valid PaymentIntent from any successful transaction and replay it in the context of a different, potentially more expensive purchase.

Root Cause

The root cause is a missing authorization check (CWE-862) in the payment verification logic. The vulnerable code fails to implement proper payment amount binding between the Stripe PaymentIntent and the form submission context. The verify_intent() function validates that the client possesses a valid secret but does not verify that the intent corresponds to the specific transaction being completed or that the charged amount matches the expected price.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Completing a legitimate low-value payment through a Formidable Forms Stripe integration to obtain a valid PaymentIntent
2. Capturing the PaymentIntent client secret and associated parameters from the successful transaction
3. Initiating a new high-value purchase through the same or different form on the target site
4. Replaying the previously captured PaymentIntent data in the return URL handler
5. The vulnerable handle_one_time_stripe_link_return_url function processes the intent, sees a successful status, and marks the high-value order as complete

The vulnerability is documented in the plugin source code. Technical details can be found in the FrmStrpLiteHooksController.php and FrmStrpLiteLinkController.php files in the WordPress plugin repository. The Wordfence vulnerability report provides additional context on the security implications.

Detection Methods for CVE-2026-2890

Indicators of Compromise

• Multiple high-value orders marked as complete with payment amounts that don't match Stripe transaction records
• Order completion events that reference PaymentIntents from different transaction contexts
• Discrepancies between Stripe dashboard transaction amounts and WordPress order values
• Repeated use of the same PaymentIntent client secret across multiple form submissions

Detection Strategies

• Implement server-side logging to capture all payment verification requests including PaymentIntent IDs and expected amounts
• Cross-reference Formidable Forms payment completion records with actual Stripe transaction data via API
• Monitor for unusual patterns such as successful high-value orders from IP addresses that recently completed low-value transactions
• Configure Web Application Firewall (WAF) rules to detect PaymentIntent parameter manipulation in return URLs

Monitoring Recommendations

• Enable detailed logging for all Stripe webhook events and return URL handlers in the Formidable Forms plugin
• Set up automated reconciliation between WordPress payment records and Stripe Dashboard transactions
• Configure alerts for orders where the recorded payment amount differs from the form's expected price
• Monitor access logs for repeated requests to Stripe return URL endpoints with similar parameters

How to Mitigate CVE-2026-2890

Immediate Actions Required

• Update Formidable Forms plugin to a version newer than 6.28 when a patch becomes available
• Audit recent transactions to identify any potential fraudulent payments that exploited this vulnerability
• Temporarily disable Stripe Link payment functionality if high-value transactions are processed
• Implement server-side payment verification that independently confirms charged amounts via Stripe API

Patch Information

Monitor the Formidable Forms plugin changelog and the WordPress plugin repository for security updates addressing this payment integrity bypass. The Wordfence vulnerability report should be consulted for the latest remediation guidance once a patch is released.

Workarounds

• Implement Stripe webhook verification as the primary payment confirmation method rather than relying on return URL handlers
• Add custom validation logic to verify PaymentIntent amounts match expected form values before marking orders complete
• Consider using Stripe Checkout Sessions which provide stronger binding between payment intents and specific transactions
• Temporarily restrict access to payment forms to authenticated users only to reduce attack surface

# Verify Formidable Forms version and check for updates
wp plugin list --name=formidable --format=table
wp plugin update formidable --dry-run

# Review recent payment records for anomalies
wp db query "SELECT * FROM wp_frm_payments WHERE created_at > DATE_SUB(NOW(), INTERVAL 30 DAY) ORDER BY amount DESC LIMIT 50;"