CVE-2026-11567

SureForms < 2.11.1 - Unauthenticated Payment Amount Bypass

The SureForms WordPress plugin before 2.11.1 does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amount, allowing unauthenticated users to underpay for the configured product or subscription. Forms using a fixed configured price are not affected.

We have discovered 12,571 live websites that are affected by CVE-2026-11567.

Run a Free Instant Scan



Affected Software

Product  SureForms
Category Wordpress Plugins
Vulnerable Domains12,571 live websites (90% of SureForms install base)
Vulnerable Versions
  • from 0 through 2.11.1
Vulnerable Versions Count69 versions ( 97% of all versions)


Common Weakness Enumeration

CWE-284 Improper Access Control



Details

  • Published - Jul 14, 2026
  • Updated - Jul 14, 2026

Credits

  • Yaswanth Reddy Sunkara (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-11567
United States4,165 websites


Germany2,026 websites
Cyprus823 websites
France747 websites
GB454 websites
Netherlands373 websites
India360 websites
Poland328 websites
Spain295 websites
Canada286 websites

Website Distribution by TLD

Number of websites using CVE-2026-11567
.com5,975 websites
.de938 websites
.org565 websites
.fr464 websites
.net445 websites
.nl351 websites
.pl269 websites
.co.uk236 websites
.it231 websites
.com.br201 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-11567

Top websites that are affected by CVE-2026-11567. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
**************.be Belgium**,***
***************.com United States**,***
*********.info Cyprus***,***
********.com Cyprus***,***
************.org Germany***,***
********.com United States***,***
*******************.com Bulgaria***,***
*******************.com GB***,***
*********.com Germany***,***
*********.com United States***,***
See full domain list

FAQ

CVE-2026-11567 is Improper Access Control in SureForms
A total of 12,571 websites have been identified as vulnerable to CVE-2026-11567, based on global website indexing conducted by WebTechSurvey.
The SureForms is affected by the CVE-2026-11567 vulnerability.
SureForms versions up to 2.11.1 are vulnerable to CVE-2026-11567.
CVE-2026-11567 is resolved in version 2.11.1 of SureForms.