SureForms < 2.2.2 - Unauthenticated Stripe Payment Amount Manipulation

Description

The plugin is vulnerable to Improper Input Validation due to the plugin accepting the payment amount directly from user-controlled POST data in the 'create_payment_intent' and 'create_subscription_intent' functions without validating it against the form's configured price. This makes it possible for unauthenticated attackers to modify the payment amount to any arbitrary value when submitting a Stripe payment form, potentially purchasing products or services at significantly reduced prices.