The vulnerability lies in the Forminator "handle_stripe_single" function, which fails to properly validate a user‑controlled key and allows the same Stripe PaymentIntent to be replayed multiple times. The first replay triggers a genuine transaction with Stripe, but subsequent replays are treated as successful and trigger the plugin’s normal success‐email workflow. As a result, administrators may receive several email confirmations for a single transaction, potentially leading to the fulfillment of duplicate orders, confusion, and financial loss. The flaw is identified as CWE‑354, reflecting inadequate input validation that permits unintended reuse of data.

Vulnerable vendor: WPMUDEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder. All versions up to and including 1.42.0 are impacted; newer releases are unaffected.

The CVSS score of 5.3 indicates a medium severity. Because the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, the probability of real‑world exploitation is very low at present. Nonetheless, an attacker with knowledge of a PaymentIntent ID can unauthenticatedly craft requests to the public WordPress site’s form endpoint and replay that intent, causing false order notifications to be sent. The attack does not modify the payment itself but exploits the plugin’s email logic to mislead administrators.