Accept PayPal Payments CVE-2026-105989

No special configuration is required: exploitation targets a specific AJAX action of the Accept PayPal Payments using Contact Form 7 plugin (versions before 4.0.7) that ships without any authorization or request-validation (nonce) check, so it is reachable by remote unauthenticated attackers against default installs that have the plugin active. The limiting factors are that impact is confined to integrity - forging stored transaction statuses and writing the plugin's status metadata onto posts - with no confidentiality or availability effect, and that a site must have this particular plugin installed and running a version below 4.0.7; upgrading to 4.0.7 removes the exposure.

This is a genuine but modest-severity issue best described as a high-exposure, low-impact flaw rather than a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms it is remotely reachable with low complexity and no authentication or user interaction, which maximizes exposure; however, the impact is constrained to I:L with C:N and A:N, meaning an attacker can only tamper with data (forged PayPal transaction status and plugin status metadata written onto arbitrary posts) without reading sensitive data, taking over the site, or causing outages. The CWE-862 (Missing Authorization) classification aligns cleanly with the description. No EPSS score, KEV listing, or POC/exploit code is provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the absence of these signals, combined with the low integrity-only impact, strongly suggests this is not a widespread-exploitation priority. The practical risk is data-integrity fraud (e.g., spoofing a payment as completed), which could matter greatly for a specific site processing payments but is low-urgency across a fleet. Note the input Tags label this 'Authentication Bypass,' which conflicts with the CWE-862 Missing Authorization classification and the description (no login is bypassed; an AJAX action simply lacks an authorization/nonce check) - treat the 'Authentication Bypass' tag with caution.

An unauthenticated attacker sends a crafted request directly to the plugin's unprotected AJAX action, which performs no authorization or request-validation (nonce) check. They forge the stored transaction status of payment records and write the plugin's status metadata onto arbitrary posts - for example, marking a PayPal transaction as 'completed' to obtain goods or services without a valid payment. No public exploit code is identified at time of analysis, but exploitation is trivial given the missing checks.