CVE-2026-4987: 
WordPress vulnerability analysis and mitigation

CVE-2026-4987 is a Payment Amount Bypass vulnerability in the SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress. It affects all versions up to and including 2.5.2, allowing unauthenticated attackers to bypass configured payment-amount validation and create underpriced payment or subscription intents. The vulnerability was published on March 28, 2026, and was assigned by Wordfence. It carries a CVSS v3.1 base score of 7.5 (High) (Wordfence, Red Hat CVE).

The root cause is improper input validation (CWE-20) in the create_payment_intent() function, which performs payment amount validation solely based on a user-controlled parameter (form_id). By setting form_id to 0, an unauthenticated attacker can bypass the server-side validation logic that enforces the configured payment amount, causing the plugin to generate a Stripe payment or subscription intent at an arbitrary (underpriced) amount. No authentication or special privileges are required, and the attack is conducted entirely over the network with low complexity (Wordfence, ENISA EUVD).

Successful exploitation allows unauthenticated attackers to manipulate payment amounts for any form using the SureForms plugin, enabling them to purchase goods or services at fraudulently reduced prices or initiate subscriptions at near-zero cost. The primary impact is on data integrity and financial integrity — there is no confidentiality or availability impact. Affected WordPress site operators may suffer direct financial losses and reputational damage from fraudulent transactions processed through their payment forms (Wordfence, Wordfence Weekly Report).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.073%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It has been detected by Qualys scanners (detection ID 531161) (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites using the SureForms plugin (versions ≤ 2.5.2) with payment forms enabled, using tools like WPScan or by inspecting page source for SureForms indicators.
2. Locate the payment endpoint: Identify the REST API or AJAX endpoint that calls create_payment_intent() — typically exposed via WordPress's REST API or admin-ajax.php.
3. Craft a malicious request: Send an HTTP POST request to the payment intent endpoint, setting the form_id parameter to 0 and specifying an arbitrarily low payment amount in the request body.
4. Bypass validation: Because the server validates the payment amount based solely on the user-supplied form_id=0, it fails to look up the configured minimum amount and accepts the attacker-supplied value.
5. Complete fraudulent transaction: Use the returned underpriced Stripe payment intent to complete a payment at the manipulated amount, obtaining goods, services, or a subscription at a fraction of the intended price (Wordfence, Infinit Security).

• Network: Unusual POST requests to the SureForms payment intent endpoint (e.g., /wp-json/sureforms/v1/create-payment-intent or similar) with form_id=0 in the request body; requests originating from unexpected or anonymous IP addresses.
• Logs: WordPress access logs showing repeated or anomalous calls to the payment intent endpoint with form_id=0; Stripe dashboard showing payment intents created for unusually low amounts (e.g., $0.01 or $1.00) that do not match configured form prices.
• Application: Stripe payment records showing completed transactions at prices significantly below the configured form amounts; multiple payment intents created in rapid succession from the same IP.

WordPress site administrators should update the SureForms plugin to version 2.5.3 or later, which addresses the vulnerability by implementing server-side payment amount validation that does not rely solely on the user-supplied form_id parameter. The fix is available via the WordPress plugin repository changeset 3488858. Until patching is possible, consider temporarily disabling payment forms or restricting access to the payment intent endpoint via a web application firewall (WAF) rule that blocks requests with form_id=0 (Wordfence, WordPress Trac).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for the week of March 23–29, 2026, highlighting it as a notable payment bypass issue (Wordfence Weekly Report). Sucuri also referenced it in their March 2026 vulnerability patch roundup (Sucuri Blog). Social media activity was modest, with mentions on Mastodon by security accounts such as RedPacketSecurity and TheHackerWire, and brief coverage on infosec.exchange.