CVE-2026-66660

MediumCVSS 6.5

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

16th percentile - higher than 16% of all known CVEs

Unauthenticated Broken Access Control vulnerability in Contact Form 7 – PayPal & Stripe Add-on plugin versions up to and including 2.5.1.

An unauthenticated attacker may gain unauthorized access to functionality, potentially leading to data breaches or unauthorized changes.

Update the Contact Form 7 – PayPal & Stripe Add-on plugin to a version newer than 2.5.1.

Original NVD description (English source)

Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.