CVE-2026-1782

Root

Cause

The MetForm Pro plugin for WordPress, up to version 3.9.7, suffers from an improper input validation vulnerability in its payment integrations for Stripe and PayPal. The plugin trusts user-submitted calculation field values (via the 'mf-calculation' field) without recomputing or validating them against the configured form price [1]. This oversight allows an attacker to supply a manipulated value for the payment amount.

Exploitation

An unauthenticated attacker can exploit this by sending a specially crafted REST request to the form submission endpoint. The attack requires that the form includes a calculation field configured to compute the payment amount. No authentication is needed, and the attacker only needs network access to the WordPress site. The 'mf-calculation' field value is accepted as-is, enabling the attacker to set an arbitrary payment amount.

Impact

By manipulating the payment amount, an attacker can pay less than the intended price or even zero for products or services purchased through the form. This could lead to financial loss for the site owner and undermines the integrity of the payment process.

Mitigation

The vendor has not yet released a patched version, but users are advised to disable the calculation field in payment forms or apply input validation measures. Updating to a future version beyond 3.9.7 is recommended once available [1].