CVE-2026-2890
Published: 13 March 2026
Summary
CVE-2026-2890 is a high-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-2890 is a payment integrity bypass vulnerability affecting the Formidable Forms plugin for WordPress in all versions up to and including 6.28. The issue stems from flaws in the Stripe integration, specifically the `handle_one_time_stripe_link_return_url` function in the Stripe Link return handler, which marks payment records as complete based solely on the Stripe PaymentIntent status without verifying the charged amount against the expected payment amount. Additionally, the `verify_intent()` function only checks client secret ownership without binding intents to specific forms or actions, enabling manipulation of payment statuses.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity, as indicated by its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and association with CWE-862 (Missing Authorization). By reusing a PaymentIntent from a previously completed low-value payment, an attacker can mark a high-value payment as complete without actually paying, thereby bypassing payment for goods or services offered through affected forms.
Advisories, including the Wordfence threat intelligence report, detail the vulnerability and reference specific code locations in the plugin's Stripe controllers, such as FrmStrpLiteHooksController.php at line 92 and FrmStrpLiteLinkController.php at lines 429 and 79, highlighting the exact implementation flaws.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11756
Vulnerability details
The Formidable Forms plugin for WordPress is vulnerable to a payment integrity bypass in all versions up to, and including, 6.28. This is due to the Stripe Link return handler (`handle_one_time_stripe_link_return_url`) marking payment records as complete based solely on the…
more
Stripe PaymentIntent status without comparing the intent's charged amount against the expected payment amount, and the `verify_intent()` function validating only client secret ownership without binding intents to specific forms or actions. This makes it possible for unauthenticated attackers to reuse a PaymentIntent from a completed low-value payment to mark a high-value payment as complete, effectively bypassing payment for goods or services.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Public-facing WordPress plugin flaw directly enables remote unauth exploitation (T1190) and payment record manipulation for financial theft (T1657).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of PaymentIntent charged amount against expected payment and binding to specific forms, preventing reuse of low-value intents for high-value payments.
Enforces access control to payment record updates, requiring verification of intent attributes like amount and form specificity before marking payments complete.
Mandates timely identification, reporting, and correction of flaws in plugins like Formidable Forms, eliminating the payment integrity bypass vulnerability.