CVEvulnerability
CVE-2024-3649
5.3 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2024-05-02
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-472
Description
The Contact Form by WPForms – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to price manipulation in versions up to, and including, 1.8.7.2. This is due to a lack of controls on several product parameters. This makes it possible for unauthenticated attackers to manipulate prices, product information, and quantities for purchases made via the Stripe payment integration.
Related
Weakness · CWE (1)
- CWE-472 External Control of Assumed-Immutable Web Parameter weakness
References
- https://plugins.trac.wordpress.org/changeset/3075634 plugins.trac.wordpress.org
- https://plugins.trac.wordpress.org/changeset/3075634/wpforms-lite/trunk/assets/js/integrations/stripe/wpforms-stripe-payment-element.js plugins.trac.wordpress.org
- https://www.wordfence.com/threat-intel/vulnerabilities/id/68a509ae-9943-4b9a-8ede-2b5732e96e6d?source=cve www.wordfence.com
- https://plugins.trac.wordpress.org/changeset/3075634 plugins.trac.wordpress.org
- https://plugins.trac.wordpress.org/changeset/3075634/wpforms-lite/trunk/assets/js/integrations/stripe/wpforms-stripe-payment-element.js plugins.trac.wordpress.org
- https://www.wordfence.com/threat-intel/vulnerabilities/id/68a509ae-9943-4b9a-8ede-2b5732e96e6d?source=cve www.wordfence.com