CVE-2024-11205highCWE-862

CVE-2024-11205: high-severity vulnerability in smub WPForms – Easy Form Builder for WordPress…

WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation

Published

Follow this CVE+ Monitor WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.5epss 0.7%
In short

The WPForms WordPress plugin allows users with basic subscriber accounts to refund payments and cancel subscriptions without proper permission checks. This means attackers with low-level access can manipulate financial transactions they shouldn't be able to touch.

Technical detail

A missing capability check in the 'wpforms_is_admin_page' function allows authenticated attackers with Subscriber-level privileges or higher to perform unauthorized payment refunds and subscription cancellations through direct function calls. The vulnerability affects versions 1.8.4 through 1.9.2.1 and requires only valid WordPress authentication to exploit.

Summary generated and translated by AI from the official description.
The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to refund payments and cancel subscriptions.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
Affected products
smub · WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
Related CVEs — smub WPForms – Easy Form Builder for WordPress…

In the same product, most dangerous first.

CVE-2024-3649MEDIUMContact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price ManipulationEPSS 0.7%CVE-2024-13403MEDIUMWPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML ParameterEPSS 0.4%CVE-2025-3794MEDIUMWPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' ParameterEPSS 0.3%CVE-2026-7792MEDIUMWPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook EndpointEPSS 0.3%CVE-2024-10593MEDIUMWPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log DeletionEPSS 0.3%