The SureForms WordPress plugin before 2.11.1 does not properly validate the payment amount on forms that use a dynamically‑sourced (variable/hidden) payment amount, allowing unauthenticated users to underpay for the configured product or subscription. Forms using a fixed configured price are not affected. This flaw is an improper input‑validation error that bypasses server‑side checks, permitting any visitor to manipulate the hidden payment amount field without needing credentials or administrative access.

All installations of SureForms prior to version 2.11.1 are affected. The flaw only applies to forms that use a variable or hidden payment amount, hard‑coded price are not vulnerable.

The CVSS score of 5.9 indicates a moderate severity. The EPSS score of less than 1% suggests that real‑world exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw via normal form traffic. The primary risk is financial loss due to underpayment, and the attack vector is client‑side manipulation of form data.