CVE-2024-3649

MEDIUM

The Contact Form by WPForms - WordPress <1.8.7.2 - Info Disclosure

Title source: llm

Description

The Contact Form by WPForms – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to price manipulation in versions up to, and including, 1.8.7.2. This is due to a lack of controls on several product parameters. This makes it possible for unauthenticated attackers to manipulate prices, product information, and quantities for purchases made via the Stripe payment integration.

References (3)

[Product] https://plugins.trac.wordpress.org/changeset/3075634/wpforms-lite/trunk/assets/js/integrations/stripe/wpforms-stripe-payment-element.js

[Product] https://plugins.trac.wordpress.org/changeset/3075634

[Third Party Advisory] https://www.wordfence.com/threat-intel/vulnerabilities/id/68a509ae-9943-4b9a-8ede-2b5732e96e6d?source=cve

Scores

CVSS v3 5.3

EPSS 0.0025

EPSS Percentile 48.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-472

Status published

Products (2)

smub/Contact Form by WPForms – Drag & Drop Form Builder for WordPress < 1.8.7.2

smub/WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More < 1.8.7.2

Published May 02, 2024

Tracked Since Feb 18, 2026