{"id":"CVE-2024-11205","aliases":["EUVD-2024-34017","GHSA-w65x-762v-xpf6"],"status":"published","title":"WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation","description":"The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to refund payments and cancel subscriptions.","severity":{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00722,"percentile":0.54323,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2024-12-10T04:23:41Z","modified":"2026-06-17T06:57:16Z","products":[{"vendor":"smub","product":"wpforms – easy form builder for wordpress – contact forms, payment forms, surveys, \u0026 more"},{"vendor":"wpforms","product":"wpforms"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66898509-a93c-4dc3-bf01-1743daaa0ff1?source=cve","tags":["Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.9.2.1/includes/functions/checks.php#L191","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.9.2.1/src/Integrations/Stripe/Admin/Payments/SingleActionsHandler.php#L92","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.9.2.1/src/Integrations/Stripe/Admin/Payments/SingleActionsHandler.php#L148","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/changeset/3191229/wpforms-lite#file2128","tags":["Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11205"},{"url":"https://github.com/advisories/GHSA-w65x-762v-xpf6"}],"sources":{"cve":[{"id":"CVE-2024-11205","title":"WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation","description":"The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to refund payments and cancel subscriptions.","status":"published","published":"2024-12-10T04:23:41.091Z","modified":"2024-12-10T21:09:53.252Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:34:19.615831Z"}],"euvd":[{"id":"EUVD-2024-34017","description":"The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to refund payments and cancel subscriptions.","status":"published","published":"2024-12-10T04:23:41Z","modified":"2024-12-10T21:09:53Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:04:37.743244Z"}],"ghsa":[{"id":"GHSA-w65x-762v-xpf6","title":"The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a...","description":"The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to refund payments and cancel subscriptions.","status":"published","published":"2024-12-10T06:31:40Z","modified":"2024-12-10T06:31:40Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:59:06.448773Z"}],"nvd":[{"id":"CVE-2024-11205","description":"The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to refund payments and cancel subscriptions.","status":"published","published":"2024-12-10T05:15:05.51Z","modified":"2026-06-17T06:57:16.47Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:10:39.434419Z"}]}}