https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 19:43:45 +0000 https://cve.radiocsirt.org/vuln/cve-2026-2890 <p><strong>Affected:</strong> strategy11team Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form &amp; Custom Form Builder</p> <p>The Formidable Forms plugin for WordPress is vulnerable to a payment integrity bypass in all versions up to, and including, 6.28. This is due to the Stripe Link return handler (`handle_one_time_stripe_link_return_url`) marking payment records as complete based solely on the Stripe PaymentIntent status without comparing the intent&#39;s charged amount against the expected payment amount, and the `verify_intent()` function validating only client secret ownership without binding intents to specific forms or actions. This makes it possible for unauthenticated attackers to reuse a PaymentIntent from a completed low-value payment to mark a high-value payment as complete, effectively bypassing payment for goods or services.</p> <p><strong>Affected:</strong> strategy11team Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form &amp; Custom Form Builder</p> <p>The Formidable Forms plugin for WordPress is vulnerable to a payment integrity bypass in all versions up to, and including, 6.28. This is due to the Stripe Link return handler (`handle_one_time_stripe_link_return_url`) marking payment records as complete based solely on the Stripe PaymentIntent status without comparing the intent&#39;s charged amount against the expected payment amount, and the `verify_intent()` function validating only client secret ownership without binding intents to specific forms or actions. This makes it possible for unauthenticated attackers to reuse a PaymentIntent from a completed low-value payment to mark a high-value payment as complete, effectively bypassing payment for goods or services.</p> https://cve.radiocsirt.org/vuln/cve-2026-2890