CVE-2026-105989
UnknownSummary
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the plugin's status metadata onto arbitrary posts.
Risk Assessment
An attacker can manipulate transaction statuses, potentially leading to financial fraud, and also modify arbitrary posts, which can disrupt the integrity of site content.
Recommendation
Update the Accept PayPal Payments using Contact Form 7 plugin to version 4.0.7 or later, which includes the security fix.
Other vulnerabilities in Accept PayPal Payments using Contact Form 7
See all- CVE-2026-105990Unknown
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data (name, email, telephone, postal address, message) and payment metadata of everyone who submitted a payment form.
- CVE-2026-39707Medium
The Accept PayPal Payments using Contact Form 7 extension for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 4.0.4.
Original NVD description (English source)
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7's status metadata onto arbitrary posts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS