The Formidable Forms plugin for WordPress contains an authorization bypass vulnerability (CWE-639) in its `frm_strp_amount` AJAX handler (`update_intent_ajax`). This handler overwrites the global `$_POST` data with attacker-controlled JSON input and uses these values in `generate_false_entry()` to recalculate payment amounts. The handler relies on a nonce exposed in JavaScript for CSRF protection but lacks proper authorization checks, allowing unauthenticated attackers to manipulate PaymentIntent amounts before payment completion. This affects all plugin versions up to and including 6.28 and enables attackers to pay reduced amounts for services or goods when dynamic pricing with field shortcodes is used.

An unauthenticated attacker can bypass authorization controls to manipulate payment amounts on affected forms, potentially paying less than the intended price for goods or services. This results in an integrity impact on payment processing but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling dynamic pricing features that rely on field shortcodes or restricting access to the vulnerable AJAX handler. Monitor vendor communications for updates and apply patches promptly once released.