CVE-2026-2890: 
WordPress vulnerability analysis and mitigation

CVE-2026-2890 is a payment integrity bypass vulnerability in the Formidable Forms plugin for WordPress, affecting all versions up to and including 6.28. The flaw allows unauthenticated attackers to reuse a PaymentIntent from a completed low-value Stripe payment to mark a high-value payment as complete, effectively obtaining goods or services without paying the correct amount. It was published on March 13, 2026, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Wordfence, ENISA EUVD).

The root cause is classified as CWE-862 (Missing Authorization). Two specific code deficiencies combine to create the vulnerability: the handle_one_time_stripe_link_return_url handler in FrmStrpLiteLinkController.php marks payment records as complete based solely on the Stripe PaymentIntent status without verifying that the charged amount matches the expected payment amount; and the verify_intent() function validates only client secret ownership without binding the PaymentIntent to a specific form or expected transaction value. An unauthenticated attacker can exploit this by completing a legitimate low-value payment to obtain a valid PaymentIntent and client secret, then replaying that intent against a higher-value form submission (Wordfence, WordPress Trac).

Successful exploitation allows unauthenticated attackers to bypass payment requirements entirely, obtaining goods or services at a fraction of their actual cost or for free. The integrity impact is high — payment records are fraudulently marked as complete — while confidentiality and availability are unaffected. Businesses using Formidable Forms with Stripe payment integration for e-commerce, registrations, or subscriptions are directly at financial risk (Wordfence, Search Engine Journal).

No public exploit code or active in-the-wild exploitation campaigns have been reported as of the available data. The EPSS score is approximately 0.047%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It has been detected by Qualys (detection ID 531143) and is indexed in multiple vulnerability tracking platforms (Wordfence, Qualys).

1. Reconnaissance: Identify WordPress sites using the Formidable Forms plugin (version ≤ 6.28) with Stripe payment integration enabled, using tools like WPScan or passive enumeration of plugin assets.
2. Initiate a low-value payment: Submit a legitimate, low-cost form (e.g., a $1 item) through the target site's Formidable Forms Stripe-integrated form to obtain a valid PaymentIntent ID and client secret.
3. Complete the low-value payment: Finalize the Stripe payment to bring the PaymentIntent to a succeeded status, making it reusable for the bypass.
4. Identify a high-value target form: Locate a higher-value form on the same site (e.g., a premium product or service registration form) that uses the same Stripe Link return handler.
5. Replay the PaymentIntent: Craft a request to the handle_one_time_stripe_link_return_url endpoint, supplying the previously completed PaymentIntent ID and client secret in place of the expected high-value intent.
6. Bypass payment: Because verify_intent() only checks client secret ownership and the handler does not compare charged amounts, the high-value payment record is marked as complete, granting access to the goods or services without the correct payment (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing repeated or unusual POST/GET requests to Stripe Link return URL endpoints (e.g., URLs containing stripe_link_return or frm_stripe_link) with mismatched form IDs or reused PaymentIntent parameters.
• Application Data: Payment records in the WordPress database marked as complete where the recorded Stripe PaymentIntent amount does not match the form's expected payment amount; multiple completed orders associated with the same Stripe PaymentIntent ID.
• Network: Outbound Stripe API validation calls originating from the server for PaymentIntents that were originally created for different, lower-value transactions.
• Behavioral: A pattern of low-value Stripe payments followed immediately by high-value order completions from the same or different IP addresses, suggesting PaymentIntent reuse (Wordfence).

Site administrators should update the Formidable Forms plugin to a version beyond 6.28 that addresses this vulnerability, as the fix requires the payment handler to validate the charged amount against the expected amount and bind PaymentIntents to specific forms. Until a patch is applied, consider disabling Stripe Link payment functionality within Formidable Forms or implementing server-side amount verification via Stripe webhooks as a compensating control. Regularly audit Stripe payment records against expected form amounts to detect any retroactive exploitation (Wordfence, Wordfence Weekly Report).

Wordfence published the vulnerability in their weekly WordPress vulnerability report for March 9–15, 2026, highlighting it as a notable payment integrity issue (Wordfence Weekly Report). Search Engine Journal covered the flaw with the headline "Formidable Forms Flaw Lets Attackers Pay Less for Expensive Purchases," drawing broader public attention (Search Engine Journal). Sucuri included it in their March 2026 vulnerability patch roundup (Sucuri Blog). Social media discussion was moderate, with mentions on Mastodon and Bluesky from security-focused accounts.