The Forminator plugin for WordPress has a flaw that allows an attacker lacking authentication to submit completed forms by reusing a previously successful low‑value Stripe PaymentIntent. Because the plugin does not confirm that the user is allowed to perform the payment action, the attacker can supply a valid PaymentIntent identifier in the public payment flow and receive the high‑value form payment without having to complete the original high‑value transaction. This bypass enables underpayment or complete payment evasion, undermining the financial integrity of the site.

The vulnerability affects the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin from wpmudev. All versions up to and including 1.52.0 are impacted; later releases have addressed the authorization check. Any WordPress site that relies on the plugin for processing Stripe payments before version 1.52.0 is at risk.

With a CVSS score of 5.3 the CVE represents moderate severity, and the EPSS score is not reported. The issue is not currently listed in CISA KEV. The primary attack vector is likely the public payment submission endpoint, where an unauthenticated user can craft an HTTP request that includes a previously succeeded Stripe PaymentIntent identifier. An attacker only needs to know or guess a valid PaymentIntent ID; no privileged credentials are required. Once the request is accepted, the payment workflow processes it as a completed transaction, effectively bypassing the intended authorization.