The SureForms plugin for WordPress contains a critical payment bypass vulnerability that allows unauthenticated attackers to manipulate transaction amounts, posing a significant financial risk to site operators.

The vulnerability exists within the create_payment_intent function, which fails to perform server-side validation of payment amounts. By manipulating the form_id parameter, unauthenticated attackers can force the application to accept arbitrary, underpriced payment amounts.

Successful exploitation of this flaw directly impacts the financial integrity of e-commerce operations by allowing attackers to pay significantly less than the intended price for goods or services. Given the CVSS score of 7.5, this high-severity vulnerability could lead to substantial revenue loss and requires immediate attention to prevent fraudulent activity.

Immediate Action: Update the SureForms plugin to the latest version, which contains the necessary patches to enforce correct payment validation.

Proactive Monitoring: Review transaction logs for anomalous payment amounts or recurring orders with identical, unusually low values that may indicate exploitation attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) to block requests containing suspicious parameters, though an application update remains the only definitive fix.

Public Exploit Available: No (Nuclei detection template only)

The severity of this vulnerability, combined with the ease of exploitation, necessitates an immediate update to the patched version of the SureForms plugin. Administrators should prioritize this remediation to prevent financial fraud and ensure that payment processing logic remains secure against unauthorized manipulation.