The Formidable Forms plugin for WordPress is vulnerable to a payment integrity bypass, as described in the plugin source code where the Stripe Link return handler, key detail from plugin code: "handle_one_time_stripe_link_return_url", marks payment records as complete based solely on the Stripe PaymentIntent status without verifying the amount paid. The verify_intent() function validates only client secret ownership without binding the intent to specific forms or actions, allowing a malicious actor to reuse a low‑value PaymentIntent to incorrectly complete a high‑value payment. This flaw enables unauthenticated attackers to effectively bypass payment for goods or services, compromising financial integrity and potentially leading to revenue loss or fraudulent transaction approval.

All installations of the Formidable Forms WordPress plugin by strategy11team up to and including version 6.28 are affected. The plugin’s marketplace listing confirms version 6.28 is the latest vulnerable release, and the issue persists through all earlier releases. No alternative versions or patches are listed as mitigated.

The vulnerability is rated CVSS 7.5 (High) with an EPSS score of less than 1%, indicating low current exploitation probability. It is not listed in the CISA KEV catalog, which suggests no publicly documented exploitation yet. The likely attack vector is unauthenticated, exploiting the payment intent reuse via the Stripe Link return URL. Attackers need only access the payment intent URL to trigger the bypass; no additional credentials are required. The impact is financial, affecting the confidentiality and integrity of transaction data and potentially leading to unauthorized revenue capture.