CVE-2026-4987

High

Description

The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Payment Amount Bypass in all versions up to, and including, 2.5.2. This is due to the create_payment_intent() function performing a payment validation solely based on the value of a user-controlled parameter. This makes it possible for unauthenticated attackers to bypass configured form payment-amount validation and create underpriced payment/subscription intents by setting form_id to 0.

SeverityHigh

CVSS7.5

Exploit probability—

ProductSureForms – Contact Form, Payment Form & Other Custom Form Builder

PublishedMar 28, 2026

First seenMar 28, 2026

Weakness typeCWE-20Improper input validation

How to fix

Sources list no fixed version or patch link for this vulnerability.

Affected products

Product	Affected versions	Fixed in
brainstormforce SureForms – Contact Form, Payment Form & Other Custom Form Builder	v ≤ 2.5.2	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.