Security Advisory

CVE-2024-3649

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2024-05-02 16:52:12

Last updated 2026-04-08 16:58:30

Assigner Wordfence

CVSS score 5.3

State PUBLISHED

Description

The Contact Form by WPForms – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to price manipulation in versions up to, and including, 1.8.7.2. This is due to a lack of controls on several product parameters. This makes it possible for unauthenticated attackers to manipulate prices, product information, and quantities for purchases made via the Stripe payment integration.

← Browse all CVEs View on cve.org ↗