CVE-2024-3649

The Contact Form by WPForms – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to price manipulation in versions up to, and including, 1.8.7.2. This is due to a lack of controls on several product parameters. This makes it possible for unauthenticated attackers to manipulate prices, product information, and quantities for purchases made via the Stripe payment integration.

• CWE-472

• https://plugins.trac.wordpress.org/changeset/3075634
• https://plugins.trac.wordpress.org/changeset/3075634/wpforms-lite/trunk/assets/js/integrations/stripe/wpforms-stripe-payment-element.js
• https://www.wordfence.com/threat-intel/vulnerabilities/id/68a509ae-9943-4b9a-8ede-2b5732e96e6d?source=cve
• https://plugins.trac.wordpress.org/changeset/3075634
• https://plugins.trac.wordpress.org/changeset/3075634/wpforms-lite/trunk/assets/js/integrations/stripe/wpforms-stripe-payment-element.js
• https://www.wordfence.com/threat-intel/vulnerabilities/id/68a509ae-9943-4b9a-8ede-2b5732e96e6d?source=cve

Published

May 2, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-36482Improper input validation in some Intel(R) CIP software befo…6.7
• CVE-2024-36484In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-36485Zohocorp ManageEngine ADAudit Plus versions below 8121 are v…8.8
• CVE-2024-36486A privilege escalation vulnerability exists in the virtual m…7.8
• CVE-2024-36488Improper Access Control in some Intel(R) DSA before version …7.8
• CVE-2024-36489In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-36491FutureNet NXR series, VXR series and WXR series provided by …9.8
• CVE-2024-36492Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <=…6.4
• CVE-2024-36493A stack-based buffer overflow vulnerability exists in the wi…7.2
• CVE-2024-36494Due to missing input sanitization, an attacker can perform c…4.7
• CVE-2024-36495The application Faronics WINSelect (Standard + Enterprise) s…7.7
• CVE-2024-36496The configuration file is encrypted with a static key derive…7.5