CVE-2026-1782CWE-20

MetForm Pro <= 3.9.7 - Unauthenticated Payment Amount Manipulation via 'mf-calculation'

Medium · published April 15, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
17.8
In the wild
Unconfirmed
What it is

The MetForm Pro plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 3.9.7 This is due to the payment integrations (Stripe/PayPal) trusting a user-submitted calculation field value without recomputing or validating it against the configured form price. This makes it possible for unauthenticated attackers to manipulate the payment amount via the 'mf-calculation' field in the form submission REST request granted there exists a specific form with this particular configuration.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00266 · 17.8th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-04-15T08:28Z
EPSS history
Timeline
  • 15 APR 08:28Z
    MetForm Pro <= 3.9.7 - Unauthenticated Payment Amount Manipulation via 'mf-calculation'
    cvelistv5