CVE-2026-2890— Formidable Forms <= 6.28 - Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-2890
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Formidable Forms <= 6.28 - Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse
Source: NVD (National Vulnerability Database)
Vulnerability Description
The Formidable Forms plugin for WordPress is vulnerable to a payment integrity bypass in all versions up to, and including, 6.28. This is due to the Stripe Link return handler (`handle_one_time_stripe_link_return_url`) marking payment records as complete based solely on the Stripe PaymentIntent status without comparing the intent's charged amount against the expected payment amount, and the `verify_intent()` function validating only client secret ownership without binding intents to specific forms or actions. This makes it possible for unauthenticated attackers to reuse a PaymentIntent from a completed low-value payment to mark a high-value payment as complete, effectively bypassing payment for goods or services.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制缺失
Source: NVD (National Vulnerability Database)
Vulnerability Title
WordPress plugin Formidable Forms 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台具有在基于PHP和MySQL的服务器上架设个人博客网站的功能。WordPress plugin是一个应用插件。 WordPress plugin Formidable Forms 6.28及之前版本存在安全漏洞，该漏洞源于Stripe Link返回处理程序存在支付完整性绕过，可能导致未经身份验证的攻击者重用已完成的低价值PaymentIntent来标记高价值支
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| strategy11team | Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder | * ~ 6.28 | - |
II. Public POCs for CVE-2026-2890
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-2890
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
- CVE-2026-2888
Formidable Forms <= 6.28 - Unauthenticated Payment Amount Ma - CVE-2024-11188
Formidable Forms – Contact Form Plugin, Survey, Quiz, Paymen - CVE-2017-20194
Formidable Form Builder < 2.05.03 - Unauthenticated Informat - CVE-2017-20192
Formidable Form Builder < 2.05.03 - Unauthenticated Stored C - CVE-2024-6725
Formidable Forms <= 6.11.1 - Authenticated (Subscriber+) Sto
Same vendor: strategy11team
- CVE-2026-5100
AWP Classifieds <= 4.4.5 - Unauthenticated SQL Injection via - CVE-2026-2888
Formidable Forms <= 6.28 - Unauthenticated Payment Amount Ma - CVE-2026-1656
Business Directory Plugin <= 6.4.20 - Missing Authorization - CVE-2026-2576
Business Directory Plugin <= 6.4.21 - Unauthenticated SQL In - CVE-2024-13887
Business Directory Plugin - Easy Listing Directories for Wor
Same weakness: CWE-862
- CVE-2021-47932
WordPress TheCartPress 1.5.3.6 Privilege Escalation Unauthen - CVE-2025-15634
HCL BigFix WebUI is affected by a missing authorization vuln - CVE-2026-42297
Argo Workflows Is Missing Authorization in Sync ConfigMap Pr - CVE-2026-42174
Kirby: User avatar creation, replacement and deletion are no - CVE-2026-42137
Kirby: `pages.access/list` and `files.access/list` permissio
V. Comments for CVE-2026-2890
No comments yet