CVE-2025-3479

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 1.42.0 via the 'handle_stripe_single' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe PaymentIntent for multiple transactions. Only the first transaction is processed via Stripe, but the plugin sends a successful email message for each transaction, which may trick an administrator into fulfilling each order.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/forminator/tags/1.41.2/library/modules/custom-forms/front/front-action.php#L964	Product
https://plugins.trac.wordpress.org/changeset/3274844/	Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/c873c04e-516e-41ee-a295-b8c5235abc1b?source=cve	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wpmudev:forminator_forms:*:*:*:*:free:wordpress:*:*

History

28 May 2025, 17:54

Type	Values Removed	Values Added
Summary		(es) El complemento Forminator Forms – Contact Form, Payment Form & Custom Form Builder para WordPress es vulnerable a la repetición de pedidos en todas las versiones hasta la 1.42.0 incluida, a través de la función 'handle_stripe_single', debido a una validación insuficiente en una clave controlada por el usuario. Esto permite que atacantes no autenticados reutilicen un único PaymentIntent de Stripe para múltiples transacciones. Solo la primera transacción se procesa a través de Stripe, pero el complemento envía un correo electrónico con cada transacción realizada correctamente, lo que puede engañar al administrador para que complete cada pedido.
CPE		cpe:2.3:a:wpmudev:forminator_forms:::::free:wordpress::
References	~~() https://plugins.trac.wordpress.org/browser/forminator/tags/1.41.2/library/modules/custom-forms/front/front-action.php#L964 -~~	() https://plugins.trac.wordpress.org/browser/forminator/tags/1.41.2/library/modules/custom-forms/front/front-action.php#L964 - Product
References	~~() https://plugins.trac.wordpress.org/changeset/3274844/ -~~	() https://plugins.trac.wordpress.org/changeset/3274844/ - Patch
References	~~() https://www.wordfence.com/threat-intel/vulnerabilities/id/c873c04e-516e-41ee-a295-b8c5235abc1b?source=cve -~~	() https://www.wordfence.com/threat-intel/vulnerabilities/id/c873c04e-516e-41ee-a295-b8c5235abc1b?source=cve - Third Party Advisory
First Time		Wpmudev forminator Forms Wpmudev

17 Apr 2025, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-17 12:15

Updated : 2025-05-28 17:54

NVD link : CVE-2025-3479

Mitre link : CVE-2025-3479

CVE.ORG link : CVE-2025-3479

JSON object : View

Products Affected

wpmudev

forminator_forms

CWE

CWE-354

Improper Validation of Integrity Check Value

{"id": "CVE-2025-3479", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2025-04-17T12:15:15.633", "references": [{"url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.41.2/library/modules/custom-forms/front/front-action.php#L964", "tags": ["Product"], "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset/3274844/", "tags": ["Patch"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c873c04e-516e-41ee-a295-b8c5235abc1b?source=cve", "tags": ["Third Party Advisory"], "source": "security@wordfence.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-354"}]}], "descriptions": [{"lang": "en", "value": "The Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 1.42.0 via the 'handle_stripe_single' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe PaymentIntent for multiple transactions. Only the first transaction is processed via Stripe, but the plugin sends a successful email message for each transaction, which may trick an administrator into fulfilling each order."}, {"lang": "es", "value": "El complemento Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder para WordPress es vulnerable a la repetici\u00f3n de pedidos en todas las versiones hasta la 1.42.0 incluida, a trav\u00e9s de la funci\u00f3n 'handle_stripe_single', debido a una validaci\u00f3n insuficiente en una clave controlada por el usuario. Esto permite que atacantes no autenticados reutilicen un \u00fanico PaymentIntent de Stripe para m\u00faltiples transacciones. Solo la primera transacci\u00f3n se procesa a trav\u00e9s de Stripe, pero el complemento env\u00eda un correo electr\u00f3nico con cada transacci\u00f3n realizada correctamente, lo que puede enga\u00f1ar al administrador para que complete cada pedido."}], "lastModified": "2025-05-28T17:54:30.707", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wpmudev:forminator_forms:*:*:*:*:free:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "E8292E2B-9C8F-4153-A9FE-4370B7976DA5", "versionEndExcluding": "1.42.1"}], "operator": "OR"}]}], "sourceIdentifier": "security@wordfence.com"}

5.3 /10