The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress contains an improper input validation vulnerability (CWE-20) identified as CVE-2026-4987. The vulnerability exists because the create_payment_intent() function validates payment amounts based only on a user-controllable parameter, allowing unauthenticated attackers to bypass configured payment amount checks. By setting the form_id parameter to 0, attackers can create payment or subscription intents with reduced prices, potentially leading to financial loss. This affects all plugin versions up to 2.5.2. The CVSS v3.1 score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or vendor advisory is currently available to confirm remediation status.

An attacker can bypass payment amount validation and create underpriced payment or subscription intents, potentially causing financial loss to the site owner. The vulnerability requires no authentication and can be exploited remotely without user interaction. There is no indication of confidentiality or availability impact, but the integrity of payment transactions is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing additional server-side validation for payment amounts independent of user-controlled parameters to mitigate exploitation risk.