The SureForms plugin for WordPress allows unauthenticated users to create payment or subscription intents without respecting the configured payment amount. The vulnerability arises because the create_payment_intent() function validates the amount based solely on a user‑supplied form_id parameter. By setting form_id to 0, an attacker can bypass all payment‑amount checks and submit payment intents with a value lower than intended, potentially leading to financial loss or unauthorized transaction processing. This flaw represents a classic input validation failure (CWE‑20).

Vendors affected include brainstormforce’s SureForms contact and payment form builder for WordPress. All plugin releases up to and including version 2.5.2 are vulnerable. Hosts running any of these versions, especially those exposing public payment forms, are susceptible if the plugin remains unpatched.

The CVSS score of 7.5 indicates high severity, and although the EPSS score is unavailable, the audit indicates that the exploit is straightforward: an unauthenticated HTTP request can be crafted with form_id=0 to trigger the vulnerability. The bug does not require authentication or privileged access, making it attractive for attackers. Since the vulnerability is not listed in the CISA KEV catalog, it may not yet have known, widespread exploits, but the low barrier to exploitation warrants proactive mitigation.