CVE-2026-11567 SureForms < 2.11.1 - Unauthenticated Payment Amount Bypass
Unauthenticated attackers can bypass payment validation in SureForms by manipulating dynamic payment amounts, allowing them to underpay for products or subscriptions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-11567?
CVE-2026-11567 is a medium-severity vulnerability in Unknown SureForms, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The SureForms WordPress plugin before 2.11.1 does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amount, allowing unauthenticated users to underpay for the configured product or subscription. Forms using a fixed configured price are not affected.
Which versions are affected by CVE-2026-11567?
How do I fix CVE-2026-11567?
No fix has been published for CVE-2026-11567 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-11567 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-11567 exists.
Sources
Also known as GHSA-9r96-r77r-wwjr.