{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3479", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-04-09T19:48:06.225Z", "datePublished": "2025-04-17T11:13:06.397Z", "dateUpdated": "2026-04-08T17:21:34.121Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:34.121Z"}, "affected": [{"vendor": "wpmudev", "product": "Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.42.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 1.42.0 via the 'handle_stripe_single' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe PaymentIntent for multiple transactions. Only the first transaction is processed via Stripe, but the plugin sends a successful email message for each transaction, which may trick an administrator into fulfilling each order."}], "title": "Forminator <= 1.42.0 - Order Replay Vulnerability", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c873c04e-516e-41ee-a295-b8c5235abc1b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.41.2/library/modules/custom-forms/front/front-action.php#L964"}, {"url": "https://plugins.trac.wordpress.org/changeset/3274844/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-354 Improper Validation of Integrity Check Value", "cweId": "CWE-354", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Asaf Mozes"}], "timeline": [{"time": "2025-04-16T22:33:04.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-17T13:29:08.657207Z", "id": "CVE-2025-3479", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-17T13:39:51.779Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3479", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-17T13:29:08.657207Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-17T13:39:34.562Z"}}], "cna": {"title": "Forminator <= 1.42.0 - Order Replay Vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Asaf Mozes"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "wpmudev", "product": "Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.42.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-04-16T22:33:04.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c873c04e-516e-41ee-a295-b8c5235abc1b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.41.2/library/modules/custom-forms/front/front-action.php#L964"}, {"url": "https://plugins.trac.wordpress.org/changeset/3274844/"}], "descriptions": [{"lang": "en", "value": "The Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 1.42.0 via the 'handle_stripe_single' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe PaymentIntent for multiple transactions. Only the first transaction is processed via Stripe, but the plugin sends a successful email message for each transaction, which may trick an administrator into fulfilling each order."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-354", "description": "CWE-354 Improper Validation of Integrity Check Value"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:34.121Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3479", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:21:34.121Z", "dateReserved": "2025-04-09T19:48:06.225Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-04-17T11:13:06.397Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wpmudev:forminator_forms:*:*:*:*:free:wordpress:*:*", "matchCriteriaId": "E8292E2B-9C8F-4153-A9FE-4370B7976DA5", "versionEndExcluding": "1.42.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 1.42.0 via the 'handle_stripe_single' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe PaymentIntent for multiple transactions. Only the first transaction is processed via Stripe, but the plugin sends a successful email message for each transaction, which may trick an administrator into fulfilling each order."}, {"lang": "es", "value": "El complemento Forminator Forms \u2013 Contact Form, Payment Form &amp; Custom Form Builder para WordPress es vulnerable a la repetici\u00f3n de pedidos en todas las versiones hasta la 1.42.0 incluida, a trav\u00e9s de la funci\u00f3n 'handle_stripe_single', debido a una validaci\u00f3n insuficiente en una clave controlada por el usuario. Esto permite que atacantes no autenticados reutilicen un \u00fanico PaymentIntent de Stripe para m\u00faltiples transacciones. Solo la primera transacci\u00f3n se procesa a trav\u00e9s de Stripe, pero el complemento env\u00eda un correo electr\u00f3nico con cada transacci\u00f3n realizada correctamente, lo que puede enga\u00f1ar al administrador para que complete cada pedido."}], "id": "CVE-2025-3479", "lastModified": "2025-05-28T17:54:30.707", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2025-04-17T12:15:15.633", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.41.2/library/modules/custom-forms/front/front-action.php#L964"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3274844/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c873c04e-516e-41ee-a295-b8c5235abc1b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-354"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T23:15:04.017265+00:00", "value": {"mitigation_remediation": ["Upgrade Forminator to version 1.43 or later to apply the vendor fix.", "If an upgrade is not immediately feasible, temporarily disable all Forminator forms on the WordPress site to eliminate the attack surface.", "As a temporary workaround, add server\u2011side checks to verify that a PaymentIntent has not already triggered a success email before sending notification emails."], "summary": {"action": "Patch", "impact": "Duplicate Payment Notification & Admin Confusion"}, "threat_synthesis": {"affected_systems": "Vulnerable vendor: WPMUDEV Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder. All versions up to and including 1.42.0 are impacted; newer releases are unaffected.", "description_and_impact": "The vulnerability lies in the Forminator \"handle_stripe_single\" function, which fails to properly validate a user\u2011controlled key and allows the same Stripe PaymentIntent to be replayed multiple times. The first replay triggers a genuine transaction with Stripe, but subsequent replays are treated as successful and trigger the plugin\u2019s normal success\u2010email workflow. As a result, administrators may receive several email confirmations for a single transaction, potentially leading to the fulfillment of duplicate orders, confusion, and financial loss. The flaw is identified as CWE\u2011354, reflecting inadequate input validation that permits unintended reuse of data.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a medium severity. Because the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, the probability of real\u2011world exploitation is very low at present. Nonetheless, an attacker with knowledge of a PaymentIntent ID can unauthenticatedly craft requests to the public WordPress site\u2019s form endpoint and replay that intent, causing false order notifications to be sent. The attack does not modify the payment itself but exploits the plugin\u2019s email logic to mislead administrators."}}}}, "created": "2026-04-20T23:15:06.312418+00:00", "updated": "2026-04-20T23:15:06.312434+00:00", "vendors": []}