The vulnerability allows an attacker to inject a crafted payload into the Stripe payment flow, causing the plugin to accept an arbitrary payment amount supplied by the user. Because the amount field is taken directly from untrusted POST data without verification against the specified form price, the attacker can set the amount to zero or to a value below the intended cost, resulting in financial loss for the site owner and a potential gain of goods or services for the attacker.

WordPress sites using the SureForms drag‑and‑drop form builder from brainstormforce, specifically all releases up to and including version 2.2.1. This includes the payment form, survey, quiz, and calculator modules. Any installation that has not been upgraded beyond 2.2.1 remains vulnerable to this input‑validation flaw.

The CVSS score of 7.5 indicates a high‑severity flaw with significant impact on the integrity of financial transactions. The EPSS score of less than 1% suggests that active exploitation is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalog, meaning no widespread known exploits have been observed. The likely attack vector is an unauthenticated network attacker who submits a POST request to the payment endpoint with a manipulated amount field; such an attacker can influence the charge amount before the transaction is finalized with Stripe.