CVE-2026-2888

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2888", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-20T17:11:27.201Z", "datePublished": "2026-03-13T08:25:17.249Z", "dateUpdated": "2026-04-08T17:17:50.074Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:17:50.074Z"}, "affected": [{"vendor": "strategy11team", "product": "Formidable Forms \u2013 Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.28", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Formidable Forms plugin for WordPress is vulnerable to an authorization bypass through user-controlled key in all versions up to, and including, 6.28. This is due to the `frm_strp_amount` AJAX handler (`update_intent_ajax`) overwriting the global `$_POST` data with attacker-controlled JSON input and then using those values to recalculate payment amounts via field shortcode resolution in `generate_false_entry()`. The handler relies on a nonce that is publicly exposed in the page's JavaScript (`frm_stripe_vars.nonce`), which provides CSRF protection but not authorization. This makes it possible for unauthenticated attackers to manipulate PaymentIntent amounts before payment completion on forms using dynamic pricing with field shortcodes, effectively paying a reduced amount for goods or services."}], "title": "Formidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b8be3b6e-a035-4e6f-ba2b-ce9e59ebf2e0?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/formidable/tags/6.28/stripe/models/FrmStrpLiteAuth.php#L322"}, {"url": "https://plugins.trac.wordpress.org/browser/formidable/tags/6.28/stripe/models/FrmStrpLiteAuth.php#L402"}, {"url": "https://plugins.trac.wordpress.org/browser/formidable/tags/6.28/stripe/controllers/FrmStrpLiteHooksController.php#L88"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3480574%40formidable%2Ftrunk&old=3460198%40formidable%2Ftrunk&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Michael Iden"}], "timeline": [{"time": "2026-03-12T19:24:45.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T16:04:01.348416Z", "id": "CVE-2026-2888", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T16:04:08.409Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2888", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-13T16:04:01.348416Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T16:04:05.024Z"}}], "cna": {"title": "Formidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Michael Iden"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "strategy11team", "product": "Formidable Forms \u2013 Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.28"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-12T19:24:45.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b8be3b6e-a035-4e6f-ba2b-ce9e59ebf2e0?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/formidable/tags/6.28/stripe/models/FrmStrpLiteAuth.php#L322"}, {"url": "https://plugins.trac.wordpress.org/browser/formidable/tags/6.28/stripe/models/FrmStrpLiteAuth.php#L402"}, {"url": "https://plugins.trac.wordpress.org/browser/formidable/tags/6.28/stripe/controllers/FrmStrpLiteHooksController.php#L88"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3480574%40formidable%2Ftrunk&old=3460198%40formidable%2Ftrunk&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Formidable Forms plugin for WordPress is vulnerable to an authorization bypass through user-controlled key in all versions up to, and including, 6.28. This is due to the `frm_strp_amount` AJAX handler (`update_intent_ajax`) overwriting the global `$_POST` data with attacker-controlled JSON input and then using those values to recalculate payment amounts via field shortcode resolution in `generate_false_entry()`. The handler relies on a nonce that is publicly exposed in the page's JavaScript (`frm_stripe_vars.nonce`), which provides CSRF protection but not authorization. This makes it possible for unauthenticated attackers to manipulate PaymentIntent amounts before payment completion on forms using dynamic pricing with field shortcodes, effectively paying a reduced amount for goods or services."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:17:50.074Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2888", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:17:50.074Z", "dateReserved": "2026-02-20T17:11:27.201Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-13T08:25:17.249Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Formidable Forms \u2013 Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder", "vendor": "strategy11team", "versions": [{"lessThanOrEqual": "6.28", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Formidable Forms plugin for WordPress is vulnerable to an authorization bypass through user-controlled key in all versions up to, and including, 6.28. This is due to the `frm_strp_amount` AJAX handler (`update_intent_ajax`) overwriting the global `$_POST` data with attacker-controlled JSON input and then using those values to recalculate payment amounts via field shortcode resolution in `generate_false_entry()`. The handler relies on a nonce that is publicly exposed in the page's JavaScript (`frm_stripe_vars.nonce`), which provides CSRF protection but not authorization. This makes it possible for unauthenticated attackers to manipulate PaymentIntent amounts before payment completion on forms using dynamic pricing with field shortcodes, effectively paying a reduced amount for goods or services."}, {"lang": "es", "value": "El plugin Formidable Forms para WordPress es vulnerable a un bypass de autorizaci\u00f3n a trav\u00e9s de una clave controlada por el usuario en todas las versiones hasta la 6.28, inclusive. Esto se debe a que el gestor AJAX `frm_strp_amount` (`update_intent_ajax`) sobrescribe los datos globales `$_POST` con entrada JSON controlada por el atacante y luego utiliza esos valores para recalcular los importes de pago a trav\u00e9s de la resoluci\u00f3n de shortcode de campo en `generate_false_entry()`. El gestor se basa en un nonce que est\u00e1 expuesto p\u00fablicamente en el JavaScript de la p\u00e1gina (`frm_stripe_vars.nonce`), lo que proporciona protecci\u00f3n CSRF pero no autorizaci\u00f3n. Esto hace posible que atacantes no autenticados manipulen los importes de PaymentIntent antes de la finalizaci\u00f3n del pago en formularios que utilizan precios din\u00e1micos con shortcodes de campo, pagando efectivamente una cantidad reducida por bienes o servicios."}], "id": "CVE-2026-2888", "lastModified": "2026-06-17T10:31:58.540", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2888", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T16:04:01.348416Z", "version": "2.0.3"}}]}, "published": "2026-03-13T19:54:34.707", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/formidable/tags/6.28/stripe/controllers/FrmStrpLiteHooksController.php#L88"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/formidable/tags/6.28/stripe/models/FrmStrpLiteAuth.php#L322"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/formidable/tags/6.28/stripe/models/FrmStrpLiteAuth.php#L402"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3480574%40formidable%2Ftrunk&old=3460198%40formidable%2Ftrunk&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b8be3b6e-a035-4e6f-ba2b-ce9e59ebf2e0?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,6.28]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Formidable Forms \u2013 Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder", "source": "cna", "vendor": "strategy11team"}, "product": "formidable_forms_\u2013_contact_form_plugin,_survey,_quiz,_payment,_calculator_form_&_custom_form_builder", "vendor": "strategy11team"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-19T15:26:15.530264+00:00", "value": {"mitigation_remediation": ["Upgrade the Formidable Forms plugin to a version newer than 6.28 to remove the vulnerable AJAX handler.", "If an immediate upgrade is not possible, disable the Stripe payment integration or block access to the update_intent_ajax endpoint to prevent unauthorized payment manipulation.", "Monitor the vendor's security advisories for further patches and apply any updates as soon as they become available."], "summary": {"action": "Immediate Patch", "impact": "Payment Amount Manipulation"}, "threat_synthesis": {"affected_systems": "All releases of the strategy11team Formidable Forms plugin up to and including version 6.28 are affected. The vulnerability impacts WordPress sites that use those plugin versions and enable Stripe payment integration with dynamic pricing field shortcodes. No other vendors or product lines are reported as affected.", "description_and_impact": "The Formidable Forms plugin for WordPress is vulnerable to an authorization bypass that allows an attacker to manipulate the amount charged on a payment form. The flaw lies in the frm_strp_amount AJAX handler (update_intent_ajax), which overwrites the global $_POST data with attacker\u2011controlled JSON and then recalculates payment amounts by resolving field shortcodes in generate_false_entry(). Because the handler relies only on a publicly exposed nonce for CSRF protection, it does not provide proper authorization. An unauthenticated attacker can submit a crafted AJAX request to reduce the amount paid on forms that use dynamic pricing and Stripe payment integration, leading to potential financial loss for the site owner.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate severity. The EPSS score is below 1%, suggesting a currently low probability of widespread exploitation, and the vulnerability is not listed in CISA\u2019s KEV catalog. Attackers can exploit the flaw without authentication by sending a crafted AJAX request to the update_intent_ajax action from any external origin; the publicly exposed nonce does not prevent this. The impact is primarily financial loss, and the attacker only needs internet connectivity and knowledge of the WordPress admin\u2011ajax endpoint. Overall, the risk is moderate but should be mitigated promptly."}}}}, "created": "2026-03-16T09:37:53.944927+00:00", "updated": "2026-03-23T09:59:39.529073+00:00", "vendors": ["strategy11team", "strategy11team$PRODUCT$formidable_forms_\u2013_contact_form_plugin,_survey,_quiz,_payment,_calculator_form_&_custom_form_builder", "wordpress", "wordpress$PRODUCT$wordpress"]}