PT-2026-28706 · WordPress · Sureforms+1

Jack Pas · Published 2026-03-28 · Updated 2026-03-29 · CVE-2026-4987

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress versions up to and including 2.5.2

Description The SureForms plugin is susceptible to a Payment Amount Bypass issue. This occurs because the create payment intent() function relies on a user-controlled parameter for payment validation. This allows unauthenticated attackers to circumvent payment amount validation and create underpriced payment or subscription intents by setting the form id parameter to 0.

Recommendations Update SureForms to a version later than 2.5.2

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-4987

Affected Products

Sureforms

Wordpress

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-4987 · Security Note
• https://twitter.com/CVEarity/status/2037778330360144275 · Twitter Post
• https://twitter.com/cyberbivash/status/2037752552008098000 · Twitter Post
• https://twitter.com/CVEnew/status/2037719337239498817 · Twitter Post
• https://twitter.com/cyberbivash/status/2037789374826324108 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3488858/sureforms · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c4772b32-a730-44f2-b43c-f9bd5abb6541?source=cve · Note
• https://twitter.com/EdgeDetectOps/status/2038043636865089970 · Twitter Post
• https://twitter.com/cyberbivash/status/2037722863776444491 · Twitter Post