Detection Guidance

This vulnerability involves manipulation of the 'mf-calculation' field in the form submission REST request to the MetForm Pro WordPress plugin. Detection would involve monitoring HTTP requests to the REST API endpoints of the affected WordPress site, specifically looking for suspicious or unexpected values in the 'mf-calculation' field within form submissions.

Commands to detect this could include using network monitoring tools or web server logs to filter for POST requests containing the 'mf-calculation' parameter. For example, using command-line tools like grep on web server logs:

• grep -i 'mf-calculation' /var/log/apache2/access.log
• grep -i 'mf-calculation' /var/log/nginx/access.log

Alternatively, using network packet capture tools like tcpdump or Wireshark to filter HTTP POST requests containing 'mf-calculation' in the payload could help identify exploitation attempts.

Useful 0 Not Useful 0

Executive Summary

The MetForm Pro plugin for WordPress has a vulnerability related to improper input validation in all versions up to and including 3.9.7. Specifically, the payment integrations with Stripe and PayPal trust a user-submitted calculation field value without verifying or recalculating it against the actual configured form price. This means that an unauthenticated attacker can manipulate the payment amount by altering the 'mf-calculation' field in the form submission REST request, provided there is a form configured in a particular way.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unauthenticated attacker to manipulate the payment amount submitted through the MetForm Pro plugin. As a result, attackers could potentially pay less than the intended amount or bypass payment requirements by altering the 'mf-calculation' field. This could lead to financial loss or unauthorized access to paid services or products.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the MetForm Pro plugin to a version later than 3.9.7 where this vulnerability is fixed.

If an immediate update is not possible, consider disabling or restricting access to the payment integration features (Stripe/PayPal) in the plugin until a patch is applied.

Additionally, monitor form submissions for suspicious 'mf-calculation' values and implement server-side validation to ensure payment amounts match configured form prices.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the vulnerability in the MetForm Pro plugin affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0