EUVD-2026-35351
GHSA-xjpm-62p5-jw4j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from Vendor (wpscan) · only source for this CVE.
CVSS VectorVendor: wpscan
Lifecycle Timeline
5DescriptionCVE.org
The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before processing them, allowing unauthenticated attackers to forge webhook payloads and manipulate the payment state of arbitrary transactions.
AnalysisAI
WPForms WordPress plugin versions prior to 1.10.0.5 allow unauthenticated remote attackers to forge PayPal webhook payloads and manipulate the payment state of arbitrary transactions due to absent webhook authenticity verification. The endpoint blindly processes incoming PayPal webhook events without validating their origin or integrity, enabling attackers to mark pending or failed payments as completed. No public exploit has been identified at time of analysis, and EPSS at 0.02% (7th percentile) reflects low current exploitation activity, though the business impact of fraudulent payment confirmation can materially exceed what the CVSS integrity score suggests.
Technical ContextAI
WPForms is a widely deployed WordPress form builder plugin that integrates with PayPal for payment collection. PayPal's webhook system sends event notifications (e.g., payment completed, payment reversed) to a registered endpoint on the merchant's server. Legitimate implementations are required to verify incoming webhook events against a shared secret or PayPal's certificate-based signing mechanism before acting on them. The affected versions (1.10.0.1 through 1.10.0.4) fail to perform this verification, directly processing webhook payloads as trusted. This maps to CWE-862 (Missing Authorization) - the software does not perform an access control check to confirm that the request originates from a legitimate, authorized source (PayPal's servers) before executing a privileged state change on transaction records. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the endpoint is network-reachable with no authentication and no user interaction required.
RemediationAI
Update WPForms to version 1.10.0.5 or later, which introduces proper verification of PayPal webhook event authenticity. This is the only confirmed fix; the patch is available from the vendor per advisory data. Site administrators should update immediately via the WordPress plugin dashboard or wp-cli. As a compensating control prior to patching, operators can temporarily disable the WPForms PayPal integration to prevent the vulnerable webhook endpoint from processing requests - note this will suspend PayPal-based payment collection entirely. Restricting access to the webhook URL via WAF or server-level rules to PayPal's published IP ranges is an additional mitigation, though IP allowlisting requires ongoing maintenance as PayPal's ranges may change. Advisory references: WPScan (https://wpscan.com/vulnerability/1d99eed6-9a16-4d5a-90f9-ab604dfd5b92/) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-4986).
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today