Forminator WordPress Plugin Authorization Bypass Vulnerability Allowing Payment Bypass

A vulnerability exists in the Forminator plugin for WordPress, specifically in versions up to and including 1.52.0. The issue stems from the plugin's failure to properly verify user authorization when handling Stripe PaymentIntent identifiers in the public payment flow. This oversight allows unauthenticated attackers to exploit the system by reusing low-value PaymentIntents to complete high-value paid forms, creating conditions for underpayment or payment bypass.

Impact

Exploitation of this vulnerability allows for unauthorized completion of paid forms, leading to underpayment or payment bypass.

Remediation

Users are advised to update the Forminator plugin to version 1.52.1 or later.