CVE-2025-3479
CVSS 3.1 Score 5.3 of 10 (medium)
Details
Published Apr 17, 2025
CWE ID 354
Summary
CVE-2025-3479 is a vulnerability affecting the Forminator Forms plugin for WordPress, specifically versions up to and including 1.42.0. Attackers can exploit insufficient validation on a user-controlled key within the 'handle_stripe_single' function, enabling them to reuse a single Stripe PaymentIntent for multiple transactions. Although only the first transaction is processed via Stripe, the plugin sends a successful email message for each transaction, potentially deceiving administrators into fulfilling the orders.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.