The Formidable Forms plugin for WordPress contains a missing authorization vulnerability (CWE-862) in its Stripe payment integration. Specifically, the function handle_one_time_stripe_link_return_url marks payments as complete based solely on the Stripe PaymentIntent status, without verifying that the charged amount matches the expected payment amount. Additionally, the verify_intent() function only validates client secret ownership and does not bind the PaymentIntent to a particular form or action. This flaw enables unauthenticated attackers to reuse a PaymentIntent from a previously completed low-value payment to fraudulently mark a higher-value payment as complete, bypassing payment requirements.

The vulnerability allows attackers to bypass payment integrity checks and mark high-value payments as complete without actually paying the correct amount. This can result in financial loss to merchants using the affected plugin, as attackers can obtain goods or services without proper payment. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users of the Formidable Forms plugin should monitor the vendor's announcements for updates addressing this vulnerability. Until a fix is available, consider disabling Stripe payment functionality or implementing additional payment verification controls if feasible.