PT-2026-28706 · WordPress · Sureforms+1

Jack Pas · Publicado 2026-03-28 · Atualizado 2026-03-29 · CVE-2026-4987

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress versions up to and including 2.5.2

Description The SureForms plugin is susceptible to a Payment Amount Bypass issue. This occurs because the create payment intent() function relies on a user-controlled parameter for payment validation. This allows unauthenticated attackers to circumvent payment amount validation and create underpriced payment or subscription intents by setting the form id parameter to 0.

Recommendations Update SureForms to a version later than 2.5.2

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2026-4987

Produtos afetados

Sureforms

Wordpress

Referências · 9

• https://twitter.com/CVEarity/status/2037778330360144275 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2037752552008098000 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2037719337239498817 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2037789374826324108 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3488858/sureforms · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/c4772b32-a730-44f2-b43c-f9bd5abb6541?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-4987 · Nota de Segurança
• https://twitter.com/EdgeDetectOps/status/2038043636865089970 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2037722863776444491 · Publicação no Twitter