CVE-2026-2890: Formidable Forms Payment Bypass Vulnerability

CVE-2026-2890 Overview

The Formidable Forms plugin for WordPress contains a critical payment integrity bypass vulnerability in all versions up to and including 6.28. The flaw resides in the Stripe payment handling logic, specifically within the handle_one_time_stripe_link_return_url function and the verify_intent() validation mechanism. This vulnerability allows unauthenticated attackers to reuse a PaymentIntent from a previously completed low-value payment to fraudulently mark a high-value payment as complete, effectively bypassing payment for goods or services.

Critical Impact
Unauthenticated attackers can exploit this payment integrity bypass to obtain goods or services without proper payment by reusing PaymentIntents from low-value transactions to complete high-value purchases.

Affected Products

Formidable Forms plugin for WordPress versions ≤ 6.28
WordPress sites using Formidable Forms with Stripe payment integration
E-commerce and payment forms utilizing Stripe Link functionality

Discovery Timeline

2026-03-13 - CVE-2026-2890 published to NVD
2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-2890

Vulnerability Analysis

This payment integrity bypass vulnerability (CWE-862: Missing Authorization) stems from insufficient validation in the Stripe payment processing workflow. The vulnerability exploits a fundamental design flaw where the payment completion handler trusts the Stripe PaymentIntent status without performing adequate verification of the transaction context.

The handle_one_time_stripe_link_return_url function marks payment records as complete based solely on whether the Stripe PaymentIntent status indicates success. Critically, it fails to compare the PaymentIntent's charged amount against the expected payment amount for the specific transaction. This creates a disconnect between what was actually charged and what the WordPress site records as paid.

Additionally, the verify_intent() function only validates client secret ownership without binding intents to specific forms or actions. This means an attacker can capture a valid PaymentIntent from any successful transaction and replay it in the context of a different, potentially more expensive purchase.

Root Cause

The root cause is a missing authorization check (CWE-862) in the payment verification logic. The vulnerable code fails to implement proper payment amount binding between the Stripe PaymentIntent and the form submission context. The verify_intent() function validates that the client possesses a valid secret but does not verify that the intent corresponds to the specific transaction being completed or that the charged amount matches the expected price.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

Completing a legitimate low-value payment through a Formidable Forms Stripe integration to obtain a valid PaymentIntent
Capturing the PaymentIntent client secret and associated parameters from the successful transaction
Initiating a new high-value purchase through the same or different form on the target site
Replaying the previously captured PaymentIntent data in the return URL handler
The vulnerable handle_one_time_stripe_link_return_url function processes the intent, sees a successful status, and marks the high-value order as complete

The vulnerability is documented in the plugin source code. Technical details can be found in the FrmStrpLiteHooksController.php and FrmStrpLiteLinkController.php files in the WordPress plugin repository. The Wordfence vulnerability report provides additional context on the security implications.

Detection Methods for CVE-2026-2890

Indicators of Compromise

Multiple high-value orders marked as complete with payment amounts that don't match Stripe transaction records
Order completion events that reference PaymentIntents from different transaction contexts
Discrepancies between Stripe dashboard transaction amounts and WordPress order values
Repeated use of the same PaymentIntent client secret across multiple form submissions

Detection Strategies

Implement server-side logging to capture all payment verification requests including PaymentIntent IDs and expected amounts
Cross-reference Formidable Forms payment completion records with actual Stripe transaction data via API
Monitor for unusual patterns such as successful high-value orders from IP addresses that recently completed low-value transactions
Configure Web Application Firewall (WAF) rules to detect PaymentIntent parameter manipulation in return URLs

Monitoring Recommendations

Enable detailed logging for all Stripe webhook events and return URL handlers in the Formidable Forms plugin
Set up automated reconciliation between WordPress payment records and Stripe Dashboard transactions
Configure alerts for orders where the recorded payment amount differs from the form's expected price
Monitor access logs for repeated requests to Stripe return URL endpoints with similar parameters

How to Mitigate CVE-2026-2890

Immediate Actions Required

Update Formidable Forms plugin to a version newer than 6.28 when a patch becomes available
Audit recent transactions to identify any potential fraudulent payments that exploited this vulnerability
Temporarily disable Stripe Link payment functionality if high-value transactions are processed
Implement server-side payment verification that independently confirms charged amounts via Stripe API

Patch Information

Monitor the Formidable Forms plugin changelog and the WordPress plugin repository for security updates addressing this payment integrity bypass. The Wordfence vulnerability report should be consulted for the latest remediation guidance once a patch is released.

Workarounds

Implement Stripe webhook verification as the primary payment confirmation method rather than relying on return URL handlers
Add custom validation logic to verify PaymentIntent amounts match expected form values before marking orders complete
Consider using Stripe Checkout Sessions which provide stronger binding between payment intents and specific transactions
Temporarily restrict access to payment forms to authenticated users only to reduce attack surface

bash

# Verify Formidable Forms version and check for updates
wp plugin list --name=formidable --format=table
wp plugin update formidable --dry-run

# Review recent payment records for anomalies
wp db query "SELECT * FROM wp_frm_payments WHERE created_at > DATE_SUB(NOW(), INTERVAL 30 DAY) ORDER BY amount DESC LIMIT 50;"