Description
The MetForm Pro plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 3.9.7 This is due to the payment integrations (Stripe/PayPal) trusting a user-submitted calculation field value without recomputing or validating it against the configured form price. This makes it possible for unauthenticated attackers to manipulate the payment amount via the 'mf-calculation' field in the form submission REST request granted there exists a specific form with this particular configuration.
Published: 2026-04-15
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Payment amount manipulation
Action: Patch
AI Analysis

Impact

MetForm Pro, a WordPress plugin, has an improper input validation flaw affecting all releases up to 3.9.7. The flaw allows attackers to manipulate the payment amount by submitting a crafted 'mf-calculation' field in a form REST request. As a result, unauthenticated attackers can trigger transactions for amounts of their choosing, potentially causing financial loss and fraud.

Affected Systems

The vulnerability impacts the Wpmet MetForm Pro plugin versions up to and including 3.9.7. The issue exists only when a form is configured with the specific payment integration settings that trust the 'mf-calculation' field.

Risk and Exploitability

The CVSS score is 5.3, indicating medium severity. EPSS data is not available, and the vulnerability is not listed in the KEV catalog. Attackers must be able to submit a form that includes the vulnerable configuration, but the attack is unauthenticated and can be performed remotely via the REST endpoint. Because the flaw requires a particular form setup, the exploitable surface is limited but still presents a realistic risk in sites that use the vulnerable plugin configuration.

Generated by OpenCVE AI on April 15, 2026 at 10:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update MetForm Pro to version 3.9.8 or newer, which removes the input‑validation issue.
  • If an immediate upgrade is not possible, modify the form to eliminate the public 'mf-calculation' field or convert it to a hidden field that does not receive client‑side input.
  • Reconfigure the payment integrations (Stripe/PayPal) to validate the transaction amount against the server‑defined price, rejecting any mismatches with the user‑submitted value.

Generated by OpenCVE AI on April 15, 2026 at 10:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 15 Apr 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 15 Apr 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wpmet
Wpmet metform Pro
Vendors & Products Wordpress
Wordpress wordpress
Wpmet
Wpmet metform Pro

Wed, 15 Apr 2026 09:00:00 +0000

Type Values Removed Values Added
Description The MetForm Pro plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 3.9.7 This is due to the payment integrations (Stripe/PayPal) trusting a user-submitted calculation field value without recomputing or validating it against the configured form price. This makes it possible for unauthenticated attackers to manipulate the payment amount via the 'mf-calculation' field in the form submission REST request granted there exists a specific form with this particular configuration.
Title MetForm Pro <= 3.9.7 - Unauthenticated Payment Amount Manipulation via 'mf-calculation'
Weaknesses CWE-20
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Wordpress Wordpress
Wpmet Metform Pro
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-15T18:07:59.020Z

Reserved: 2026-02-02T21:00:18.963Z

Link: CVE-2026-1782

cve-icon Vulnrichment

Updated: 2026-04-15T18:07:54.632Z

cve-icon NVD

Status : Received

Published: 2026-04-15T09:16:31.213

Modified: 2026-04-15T09:16:31.213

Link: CVE-2026-1782

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-15T13:49:14Z

Weaknesses