CVE-2026-11567

MediumCVSS 5.9/10Last modified Jul 14, 2026

Description

The SureForms WordPress plugin before 2.11.1 does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amount, allowing unauthenticated users to underpay for the configured product or subscription. Forms using a fixed configured price are not affected.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
Unknown	SureForms	< 2.11.1

References

https://wpscan.com/vulnerability/bd738da7-f950-4da9-bcc1-c1fe845d7faa/

Timeline

Published: Jul 14, 2026
Last modified: Jul 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1156737.5The Anti-Spam, Spam FireWall by CleanTalk WordPress plugin before 6.91 does not escape a commenter-supplied value before outputting it on an CVE-2026-1156785.3Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow pre-authentication out-of-bounds read in SNMP processing CVE-2026-1156796.5Arm Keil MDK-Middleware 8.3.0 may allow out-of-bounds reads and writes to the FTP Server RX Buffer CVE-2026-115687.5The Product Configurator for WooCommerce WordPress plugin before 1.7.3 does not perform any authorisation or post-status check before return CVE-2026-1156806.5Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow DHCPv6 Option-Walk Over-Reads and Unintended Data Retransmission CVE-2026-1156836.8A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. Epiphany registers the main-world s CVE-2026-115695.4A flaw was found in Quay. The filedrop endpoint accepts any mime type without validation, allowing an authenticated user with repository wri CVE-2026-1156939.1Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to CVE-2026-11578.8A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This affects the function setWiFiEasyCfg of the file /cgi-bin/cstecg CVE-2026-115704.2The User Submitted Posts WordPress plugin before 20260608 does not escape a submitted value before outputting it in an admin-configured dis CVE-2026-1157006.9Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed I CVE-2026-1157018.2Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust