PT-2026-25159 · Strategy11 Team · Formidable Forms – Contact Form Plugin
Michael Iden
·
Published
2026-03-13
·
Updated
2026-03-13
·
CVE-2026-2888
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Formidable Forms plugin for WordPress versions up to and including 6.28
Description
The Formidable Forms plugin for WordPress is susceptible to an authorization bypass due to a user-controlled key. This occurs because the
frm strp amount AJAX handler, also known as update intent ajax, overwrites global $ POST data with attacker-controlled JSON input. This input is then used to recalculate payment amounts through field shortcode resolution in the generate false entry() function. The handler uses a nonce, exposed in the page’s JavaScript (frm stripe vars.nonce), which provides CSRF protection but does not enforce authorization. This allows unauthenticated attackers to manipulate PaymentIntent amounts before payment completion on forms utilizing dynamic pricing with field shortcodes, potentially resulting in reduced payment amounts for goods or services.Recommendations
Versions up to and including 6.28 should be updated to a newer, fixed version when available. As a temporary workaround, consider disabling the
frm strp amount AJAX handler (update intent ajax) until a patch is available. Restrict access to the generate false entry() function to authorized users only.Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Formidable Forms – Contact Form Plugin