CVE-2026-11567 describes an improper access control vulnerability (CWE-284) in the SureForms WordPress plugin prior to version 2.11.1. The vulnerability arises because the plugin does not properly validate payment amounts on forms that use variable or hidden payment amounts sourced dynamically. This flaw allows unauthenticated attackers to submit payments with amounts lower than the configured price, effectively enabling underpayment for products or subscriptions. Forms that use a fixed configured price are not vulnerable. There is no CVSS score or vendor advisory indicating a patch or remediation status at this time.

Unauthenticated attackers can exploit this vulnerability to pay less than the intended amount for products or subscriptions processed through SureForms forms that use dynamically-sourced payment amounts. This can result in financial loss to merchants using the affected plugin versions. Fixed-price forms are not impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using dynamically-sourced payment amounts in SureForms forms or implement additional server-side validation to ensure payment amounts match expected values.