Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management <= 4.6.19 - Missing Authorization

// app/Hooks/actions.php:145
add_action('wp_ajax_wpf_submit_form', array(new \WPPayForm\App\Hooks\Handlers\SubmissionHandler(), 'handleSubmission'));
add_action('wp_ajax_nopriv_wpf_submit_form', array(new \WPPayForm\App\Hooks\Handlers\SubmissionHandler(), 'handleSubmission'));

---

// app/Hooks/Handlers/SubmissionHandler.php:33
class SubmissionHandler
{
    // ... (omitted properties)
    public function handleSubmission()
    {
        if (!isset($_REQUEST['form_data'])) {
            return;
        }
   
        parse_str($_REQUEST['form_data'], $form_data);
        // ...
        if(isset($_REQUEST['form_id'])){
            $formId = absint(sanitize_text_field(wp_unslash($_REQUEST['form_id'])));
        }
        // No nonce verification or capability check performed before processing data

---

// app/Http/Routes/routes.php:84
$router->prefix('dashboard')->withPolicy('FrontendUserPolicy')->group(function ($router) {
    $router->get('/forms/formatted', 'FormsController@formatted');
    $router->prefix('/form/{id}/entries')->group(function ($router) {
        $router->prefix('/{entryId}')->group(function ($router) {
            $router->get('/', 'SubmissionController@getSubmission')->int('id', 'entryId');
            $router->post('/cancel-subscription', 'SubmissionController@cancelSubscription')->int('id', 'entryId');
        });
    });
});

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/wp-payment-form/4.6.19/app/Hooks/Handlers/SubmissionHandler.php /home/deploy/wp-safety.org/data/plugin-versions/wp-payment-form/4.6.20/app/Hooks/Handlers/SubmissionHandler.php
--- /home/deploy/wp-safety.org/data/plugin-versions/wp-payment-form/4.6.19/app/Hooks/Handlers/SubmissionHandler.php	2026-03-11 04:30:34.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/wp-payment-form/4.6.20/app/Hooks/Handlers/SubmissionHandler.php	2026-04-16 07:13:06.000000000 +0000
@@ -40,17 +40,20 @@
         if (!isset($_REQUEST['form_data'])) {
             return;
         }
-
+        if (!isset($_REQUEST['wpf_nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['wpf_nonce'])), 'wpf_form_submission')) {
+            wp_send_json_error(array(
+                'message' => __('Security verification failed. Please refresh and try again.', 'wp-payment-form'),
+            ), 403);
+        }
+
         parse_str($_REQUEST['form_data'], $form_data);
-        $form_localize = Arr::get($_REQUEST['form_localize'], 'conditional_logic');
         // Now Validate the form please
         if(isset($_REQUEST['form_id'])){
             $formId = absint(sanitize_text_field(wp_unslash($_REQUEST['form_id'])));
         }
         $this->formID = $formId;
 
-        // Get Original Form Elements Now
-        $totalPayableAmount = intval(wp_unslash($_REQUEST['main_total'] ?? 0));
         do_action('wppayform/form_submission_activity_start', $formId);
 
         $form = Form::getForm($formId);
@@ -60,13 +63,11 @@
                 'message' => __('Invalid request. Please try again', 'wp-payment-form'),
             ), 423);
         }
- 
         $formattedElements = Form::getFormattedElements($formId);
 
         $numericCalculation = [];
         $submittedNumericCalculation = apply_filters('wppayform/dynamic_payment_calculation', '', $numericCalculation, $formattedElements, $form_data);
-
-        $this->validate($form_data, $formattedElements, $form, $form_localize);
+        $this->validate($form_data, $formattedElements, $form);
 
         $paymentMethod = apply_filters('wppayform/choose_payment_method_for_submission', '', $formattedElements['payment_method_element'], $formId, $form_data);