CVE-2026-2890
Payment Integrity Bypass in Formidable Forms WordPress Plugin
Publication date: 2026-03-13
Last updated on: 2026-03-13
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| formidable_forms | formidable_forms | to 6.28 (inc) |
| formidable | formidable_forms | to 6.28 (inc) |
| formidableforms | formidable_forms | to 6.28 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Formidable Forms plugin for WordPress has a vulnerability in its payment processing system up to version 6.28. The issue arises because the plugin marks payment records as complete based only on the Stripe PaymentIntent status, without verifying that the charged amount matches the expected payment amount. Additionally, the verification function only checks client secret ownership and does not bind the payment intents to specific forms or actions. This allows unauthenticated attackers to reuse a PaymentIntent from a completed low-value payment to falsely mark a high-value payment as complete, bypassing the actual payment.
How can this vulnerability impact me? :
This vulnerability can lead to financial loss because attackers can bypass payment requirements by reusing low-value payment intents to mark high-value payments as complete without actually paying. This means goods or services could be obtained without proper payment, potentially causing revenue loss and undermining trust in the payment system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know