CVE-2026-2888 Formidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter
Unauthenticated attackers can manipulate payment amounts in Formidable Forms by exploiting dynamic pricing logic, allowing them to pay reduced prices for goods or services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-2888?
CVE-2026-2888 is a medium-severity vulnerability in strategy11team Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Formidable Forms plugin for WordPress is vulnerable to an authorization bypass through user-controlled key in all versions up to, and including, 6.28. This is due to the `frm_strp_amount` AJAX handler (`update_intent_ajax`) overwriting the global `$_POST` data with attacker-controlled JSON input and then using those values to recalculate payment amounts via field shortcode resolution in `generate_false_entry()`. The handler relies on a nonce that is publicly exposed in the page's JavaScript (`frm_stripe_vars.nonce`), which provides CSRF protection but not authorization. This makes it possible for unauthenticated attackers to manipulate PaymentIntent amounts before payment completion on forms using dynamic pricing with field shortcodes, effectively paying a reduced amount for goods or services.
Weakness: CWE-639
Which versions are affected by CVE-2026-2888?
How do I fix CVE-2026-2888?
No fix has been published for CVE-2026-2888 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-2888 being exploited?
There is no known exploitation of CVE-2026-2888 in the wild and no public exploit code.
Sources
Also known as GHSA-xc8q-rh3x-h9m3.