SureForms < 2.6.0 - Unauthenticated Payment Amount Validation Bypass via 'form_id'

Description

The plugin is vulnerable to Payment Amount Bypass due to the create_payment_intent() function performing a payment validation solely based on the value of a user-controlled parameter. This makes it possible for unauthenticated attackers to bypass configured form payment-amount validation and create underpriced payment/subscription intents by setting form_id to 0.