CVE-2024-3649 is a CWE-472 vulnerability affecting the WPForms plugin for WordPress, specifically versions up to and including 1.8.7.2. The issue arises from a lack of validation or control over product parameters submitted through forms integrated with Stripe payments. This allows unauthenticated attackers to alter prices, product details, and quantities during purchase transactions. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity level. No known exploits in the wild have been reported, and no official patch or remediation guidance is provided in the available data.

The vulnerability enables integrity impact by allowing attackers to manipulate purchase-related parameters such as price and quantity without authentication. This could lead to financial loss or incorrect transaction processing. There is no reported confidentiality or availability impact. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting or validating form inputs related to product parameters and payment processing as a temporary mitigation.