CVE-2026-15288: CWE-20 Improper Input Validation in brainstormforce SureForms – Drag & Drop Contact Form & Form Builder, Payment Form, Survey, Quiz & Calculator
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 2.2.1. This is due to the plugin accepting the payment amount directly from user-controlled POST data in the 'create_payment_intent' and 'create_subscription_intent' functions without validating it against the form's configured price. This makes it possible for unauthenticated attackers to modify the payment amount to any arbitrary value when submitting a Stripe payment form, potentially purchasing products or services at significantly reduced prices.
AI Analysis
Technical Summary
CVE-2026-15288 is an improper input validation vulnerability (CWE-20) in the SureForms WordPress plugin up to version 2.2.1. The plugin's 'create_payment_intent' and 'create_subscription_intent' functions accept payment amounts directly from user POST data without validating them against the form's configured price. This flaw permits unauthenticated attackers to manipulate payment amounts submitted via Stripe payment forms, potentially bypassing intended pricing controls.
Potential Impact
An attacker can submit arbitrary payment amounts when using Stripe payment forms, potentially purchasing products or services at significantly reduced prices. This compromises the integrity of payment processing and can lead to financial loss for merchants using the affected plugin versions.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling Stripe payment forms or restricting access to trusted users only to mitigate risk.
CVE-2026-15288: CWE-20 Improper Input Validation in brainstormforce SureForms – Drag & Drop Contact Form & Form Builder, Payment Form, Survey, Quiz & Calculator
Description
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 2.2.1. This is due to the plugin accepting the payment amount directly from user-controlled POST data in the 'create_payment_intent' and 'create_subscription_intent' functions without validating it against the form's configured price. This makes it possible for unauthenticated attackers to modify the payment amount to any arbitrary value when submitting a Stripe payment form, potentially purchasing products or services at significantly reduced prices.
CVSS v3.1
Score 7.5high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-15288 is an improper input validation vulnerability (CWE-20) in the SureForms WordPress plugin up to version 2.2.1. The plugin's 'create_payment_intent' and 'create_subscription_intent' functions accept payment amounts directly from user POST data without validating them against the form's configured price. This flaw permits unauthenticated attackers to manipulate payment amounts submitted via Stripe payment forms, potentially bypassing intended pricing controls.
Potential Impact
An attacker can submit arbitrary payment amounts when using Stripe payment forms, potentially purchasing products or services at significantly reduced prices. This compromises the integrity of payment processing and can lead to financial loss for merchants using the affected plugin versions.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling Stripe payment forms or restricting access to trusted users only to mitigate risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-07-09T15:50:42.634Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a50809368715ace4306369c
Added to database: 07/10/2026, 05:18:11 UTC
Last enriched: 07/17/2026, 09:29:14 UTC
Last updated: 08/22/2026, 10:52:07 UTC
Views: 55
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.