Skip to content
Threat Feed
Subscribe

Vendor

SureForms

1 brief RSS
high advisory

CVE-2026-15288: SureForms WordPress Plugin Payment Manipulation Vulnerability

The SureForms - Drag and Drop Form Builder for WordPress plugin (versions up to and including 2.2.1) is vulnerable to improper input validation (CVE-2026-15288), allowing unauthenticated attackers to modify payment amounts in user-controlled POST data when submitting Stripe payment forms, enabling them to purchase products or services at arbitrarily reduced prices.

SureForms - Drag and Drop Form Builder for WordPress plugin <= 2.2.1 wordpress plugin vulnerability web payment-fraud
1r 1t 1c