The Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin versions up to 1.42.0 contain a vulnerability (CWE-354) due to insufficient validation of a user-controlled key in the 'handle_stripe_single' function. This flaw enables unauthenticated attackers to perform an order replay attack by reusing a single Stripe PaymentIntent multiple times. Although Stripe processes only the initial transaction, the plugin erroneously sends success emails for each replayed transaction, which may cause administrators to mistakenly fulfill multiple orders. The vulnerability is publicly documented with a CVSS 3.1 score of 5.3, indicating medium severity. There is no vendor advisory or patch information provided at this time.

The vulnerability allows attackers to reuse a single Stripe PaymentIntent to create multiple transactions that appear successful to the plugin and administrators, despite only one payment being processed by Stripe. This can lead to financial loss due to fraudulent order fulfillment. There is no indication of confidentiality or availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about fulfilling orders based solely on plugin-generated success emails for Stripe payments. Monitoring for unusual order patterns and manual verification of payment status directly through Stripe is recommended.