CVE-2026-4987: falha de alta gravidade em brainstormforce SureForms – Contact Form…
SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id'
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
36Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendcvss 7.5epss 1.0%
The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Payment Amount Bypass in all versions up to, and including, 2.5.2. This is due to the create_payment_intent() function performing a payment validation solely based on the value of a user-controlled parameter. This makes it possible for unauthenticated attackers to bypass configured form payment-amount validation and create underpriced payment/subscription intents by setting form_id to 0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
brainstormforce · SureForms – Contact Form, Payment Form & Other Custom Form BuilderCVEs relacionadas — brainstormforce SureForms – Contact Form…
No mesmo produto, das mais perigosas para as menos.
CVE-2025-12536MEDIUMSureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information ExposureEPSS 0.8%CVE-2025-14855HIGHSureForms <= 2.2.0 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-12713MEDIUMSureForms – Drag and Drop Form Builder for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post DisclosureEPSS 0.4%CVE-2025-10732MEDIUMSureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information DisclosureEPSS 0.3%CVE-2025-12535MEDIUMSureForms <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce DistributionEPSS 0.2%CVE-2025-10489MEDIUMSureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form CreationEPSS 0.2%