Formidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
The Formidable Forms plugin for WordPress is vulnerable to an authorization bypass through user-controlled key in all versions up to, and including, 6.28. This is due to the `frm_strp_amount` AJAX handler (`update_intent_ajax`) overwriting the global `$_POST` data with attacker-controlled JSON input and then using those values to recalculate payment amounts via field shortcode resolution in `generate_false_entry()`. The handler relies on a nonce that is publicly exposed in the page's JavaScript (`frm_stripe_vars.nonce`), which provides CSRF protection but not authorization. This makes it possible for unauthenticated attackers to manipulate PaymentIntent amounts before payment completion on forms using dynamic pricing with field shortcodes, effectively paying a reduced amount for goods or services.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| strategy11team | Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder | up to 6.28 | — | No fix listed | CNA |
- Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder Vendorstrategy11team Affected up to 6.28 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-2888
- 2026-10-03 Alias added: GHSA-xc8q-rh3x-h9m3
References
Other 5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b8be3b6e-a035-4e6f-ba2b-ce9e59ebf2e0?source=cve
- https://plugins.trac.wordpress.org/browser/formidable/tags/6.28/stripe/models/FrmStrpLiteAuth.php#L322
- https://plugins.trac.wordpress.org/browser/formidable/tags/6.28/stripe/models/FrmStrpLiteAuth.php#L402
- https://plugins.trac.wordpress.org/browser/formidable/tags/6.28/stripe/controllers/FrmStrpLiteHooksController.php#L88
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3480574%40formidable%2Ftrunk&old=3460198%40formidable%2Ftrunk&sfp_email=&sfph_mail=
More strategy11team vulnerabilities
- TI-2022-03006 AWP Classifieds Plugin < 4.3 - Unauthenticated SQLi CVSS 3.1CRITICAL 9.8
- TI-2023-02696 Formidable Forms < 6.3.1 - Subscriber+ Remote Code Execution CVSS 3.1HIGH 8.8
- TI-2023-01329 Formidable Forms < 6.2 - Unauthenticated PHP Object Injection CVSS 3.1HIGH 7.5
- TI-2023-00774 Formidable Forms < 6.1 - IP Spoofing CVSS 3.1MEDIUM 6.5
- TI-2024-09065 Formidable Forms < 6.14.1 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
- TI-2024-04133 SQL injection in strategy11team Business Directory Plugin – Easy Listing Directories for… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-2888 · CVE Program
- CVE-2026-2888 · NVD
- FIRST EPSS
- GHSA-xc8q-rh3x-h9m3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences