CVE Feed

    Dashboard / CVE / CVE-2025-3479

    CVE-2025-3479

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 1.42.0 via the 'handle_stripe_single' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe PaymentIntent for multiple transactions. Only the first transaction is processed via Stripe, but the plugin sends a successful email message for each transaction, which may trick an administrator into fulfilling each order.

    Published:Apr 17, 2025
    Last Modified:Apr 20, 2026
    EPS:Apr 17, 2025
    EPSS Score:0.00055
    CVSS Score:5.3

    Affected Products

    Vendor
    Wpmudev
    Product
    Forminator Forms

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-82220 (CVSS 5.3) — Unauthenticated Other Vulnerability Type in Forminator <= 1.57.1 versions.…
    CVE-2026-66583 (CVSS 9.8) — Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.…
    CVE-2026-28111 (CVSS 8.8) — Contributor Privilege Escalation in Forminator <= 1.56.0 versions.…
    CVE-2026-56071 (CVSS 7.1) — Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.…
    CVE-2025-14782 (CVSS 5.3) — The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to …
    CVE-2025-5341 (CVSS 6.4) — The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to …
    CVE-2025-3487 (CVSS 6.4) — The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to …
    CVE-2025-0469 (CVSS 6.4) — The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to …
    CVE-2024-7052 (CVSS 4.8) — The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which …
    CVE-2025-0470 (CVSS 6.1) — The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High