Accept PayPal Payments using Contact Form 7 vulnerabilities

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data (name, email, telephone, postal address, message) and payment metadata of everyone who submitted a payment form.

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the plugin's status metadata onto arbitrary posts.

The Accept PayPal Payments using Contact Form 7 extension for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 4.0.4.