CVE-2026-39707
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Accept PayPal Payments using Contact Form 7 extension for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 4.0.4.
Risk Assessment
An attacker can gain unauthorized access to PayPal payment settings, potentially leading to theft of funds or customer data.
Recommendation
Immediately update the extension to the latest version and verify access permissions.
Other vulnerabilities in Accept PayPal Payments using Contact Form 7
See all- CVE-2026-105990Unknown
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data (name, email, telephone, postal address, message) and payment metadata of everyone who submitted a payment form.
- CVE-2026-105989Unknown
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the plugin's status metadata onto arbitrary posts.
Original NVD description (English source)
Missing Authorization vulnerability in ZealousWeb Accept PayPal Payments using Contact Form 7 contact-form-7-paypal-extension allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accept PayPal Payments using Contact Form 7: from n/a through <= 4.0.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS