PT-2026-25153 · Strategy11 Team · Formidable Forms – Contact Form Plugin
Andres Cruciani
+1
·
Published
2026-03-13
·
Updated
2026-03-14
·
CVE-2026-2890
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Formidable Forms plugin for WordPress versions up to and including 6.28
Description
The Formidable Forms plugin for WordPress is susceptible to a payment integrity issue. This occurs because the Stripe Link return handler,
handle one time stripe link return url, confirms payment completion based only on the Stripe PaymentIntent status, without verifying the charged amount against the expected payment. Additionally, the verify intent() function only checks client secret ownership, failing to link intents to specific forms or actions. This allows unauthenticated attackers to potentially reuse a PaymentIntent from a completed low-value payment to falsely mark a high-value payment as complete, bypassing payment for goods or services.Recommendations
Update Formidable Forms plugin to a version beyond 6.28.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Formidable Forms – Contact Form Plugin