The Formidable Forms plugin for WordPress is vulnerable to an authorization bypass that allows an attacker to manipulate the amount charged on a payment form. The flaw lies in the frm_strp_amount AJAX handler (update_intent_ajax), which overwrites the global $_POST data with attacker‑controlled JSON and then recalculates payment amounts by resolving field shortcodes in generate_false_entry(). Because the handler relies only on a publicly exposed nonce for CSRF protection, it does not provide proper authorization. An unauthenticated attacker can submit a crafted AJAX request to reduce the amount paid on forms that use dynamic pricing and Stripe payment integration, leading to potential financial loss for the site owner.

All releases of the strategy11team Formidable Forms plugin up to and including version 6.28 are affected. The vulnerability impacts WordPress sites that use those plugin versions and enable Stripe payment integration with dynamic pricing field shortcodes. No other vendors or product lines are reported as affected.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is below 1%, suggesting a currently low probability of widespread exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw without authentication by sending a crafted AJAX request to the update_intent_ajax action from any external origin; the publicly exposed nonce does not prevent this. The impact is primarily financial loss, and the attacker only needs internet connectivity and knowledge of the WordPress admin‑ajax endpoint. Overall, the risk is moderate but should be mitigated promptly.