CVE-2026-82844

MediumCVSS 5.3

Published: 14/10/2026(UTC)Updated: 14/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Summary

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway. This allows unauthenticated visitors to submit paid forms without paying, and the form's confirmation is delivered and notification emails are sent even though no order exists at the payment provider.

Risk Assessment

The organization may receive fraudulent submissions and send confirmations without receiving payment, leading to financial losses and incorrect data.

Recommendation

Update the WPForms Lite plugin to version 2.0.2.2 or later, which includes a fix for server-side payment verification.

Other vulnerabilities in WPForms Lite WordPress plugin

CVE-2026-84744Medium
The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form. This allows unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments belonging to non-public posts.

Original NVD description (English source)

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its notification emails are sent even though no order exists at the payment provider and no payment is recorded.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS