Login Request a demo
Medium severity · published May 2, 2024
CVE-2024-3649
Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation
5.3
CVSS
0.7%
EPSS
No
On KEV
Description
The Contact Form by WPForms – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to price manipulation in versions up to, and including, 1.8.7.2. This is due to a lack of controls on several product parameters. This makes it possible for unauthenticated attackers to manipulate prices, product information, and quantities for purchases made via the Stripe payment integration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More · smub
through 1.8.7.2 · source: vendor
CF
Contact Form Drag And Drop Form Builder · Wordpress
through 1.8.7.2 · source: CISA
Affected product
WE
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
smub
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-3649
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-3649
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3075634
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3075634/wpforms-lite/trunk/assets/js/integrations/stripe/wpforms-stripe-payment-element.js
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/68a509ae-9943-4b9a-8ede-2b5732e96e6d?source=cve
More from WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
6.5
CVE-2024-11205
WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation
5.4
CVE-2025-3794
WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter
5.4
CVE-2024-13403
WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter
5.3
CVE-2026-7792
WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint
4.3
CVE-2024-10593
WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion