## Summary
The SureForms – Contact Form, Payment Form & Other Custom Form Builder WordPress plugin is vulnerable to Payment Amount Bypass in all versions up to and including 2.5.2. The issue allows attackers to bypass configured payment-amount validation and create underpriced payment/subscription intents.
## Technical Details
- Root cause: the create_payment_intent() function performs payment validation solely based on a user-controlled parameter.
- Bypass technique: unauthenticated attackers can set form_id to 0 to evade the configured form payment-amount checks.
- Affected behavior: creation of payment/subscription intents with an amount lower than what the form configuration specifies.
## Affected
- WordPress plugin: SureForms – Contact Form, Payment Form & Other Custom Form Builder
- Affected versions: all versions up to and including 2.5.2
## Impact
- Unauthenticated attackers can bypass payment amount validation.
- Results in underpriced payment/subscription intents (integrity impact).
- CVSS indicates network exploitability with low attacker effort (AV:N/AC:L/PR:N/UI:N).
## Mitigation
1. Upgrade the plugin to a version greater than 2.5.2 (per the stated affected range).
2. Review payment/subscription intent creation logs for anomalous requests involving form_id=0 and unexpected underpriced intents.
3. If immediate upgrade is not possible, restrict public access to any endpoints that trigger create_payment_intent() (where applicable in your deployment) until patched.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-20