Could a Malicious Hacker Alter a Hidden Post Variable

Question

I know that a POST can be spoofed in terms of originating domain, but what about being able to change the variables of the hidden POST variables in my HTML? I am concerned that