CVE-2026-4987 PoC — SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id'

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-4987.yaml

Associated Vulnerability

Title: SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id' (CVE-2026-4987)
Description:The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Payment Amount Bypass in all versions up to, and including, 2.5.2. This is due to the create_payment_intent() function performing a payment validation solely based on the value of a user-controlled parameter. This makes it possible for unauthenticated attackers to bypass configured form payment-amount validation and create underpriced payment/subscription intents by setting form_id to 0.

Description

The SureForms plugin for WordPress is vulnerable to payment amount validation bypass in versions up to, and including, 2.5.2.
The create_payment_intent AJAX handler checks `if ($form_id > 0 && !empty($block_id))` before calling validate_payment_amount().
By sending form_id=0 (the default intval of a missing/zero value), an unauthenticated attacker completely skips the server-side
amount validation and can create Stripe payment intents with arbitrary amounts, bypassing configured pricing.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →