WPForms CVE-2026-4986

The target WordPress site must have the WPForms plugin installed at a version between 1.10.0.1 and 1.10.0.4 inclusive, and the PayPal payment integration within WPForms must be actively configured and enabled - sites using WPForms solely for non-payment forms are not exposed. The webhook endpoint must be publicly reachable over the internet. No authentication is required (CVSS PR:N), no user interaction is required (UI:N), and attack complexity is low (AC:L), meaning exploitation requires only network access and knowledge of the webhook URL and a valid transaction identifier. Exploitation is limited to integrity impact only - attackers cannot read sensitive data (C:N) or cause denial of service (A:N). Scope is unchanged (S:U), confining impact to the WordPress application itself.

The CVSS score of 5.3 (Medium) reflects low-complexity, unauthenticated network access with an integrity-only impact rated Low (I:L). However, this score likely understates real-world business risk: successful exploitation enables payment fraud by marking unpaid or reversed transactions as completed, which can result in goods or services being delivered without valid payment. EPSS at 0.02% (7th percentile) indicates very low current exploitation probability in the broader threat landscape, consistent with the absence of a CISA KEV listing and no reported POC. The combination of PR:N and AV:N means mass-scanning for vulnerable WPForms installations and automated forging of webhook payloads is technically feasible, raising the automatable risk even without confirmed exploitation. The real priority depends on whether PayPal integration is active on a given site - sites not using WPForms' PayPal addon are not exposed to this specific attack path. No conflicting signals between CVSS and description were identified.

An attacker identifies a WordPress site running WPForms with PayPal integration enabled and version below 1.10.0.5. The attacker crafts an HTTP POST request mimicking a PayPal 'payment completed' webhook event for a target transaction ID and sends it directly to the site's WPForms webhook endpoint without any authentication. The plugin processes the forged event as legitimate, updates the transaction status to completed, and may trigger order fulfillment - delivering goods or services without actual payment. No POC has been identified at time of analysis, but the attack requires only knowledge of a transaction ID and the webhook endpoint URL.