What is the CVSS score of CVE-2026-4986?

CVE-2026-4986 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-4986?

Yes, a patch is available for CVE-2026-4986. Update the affected software to the latest version immediately.

WPForms CVE-2026-4986

EUVD-2026-35351 MEDIUM

Missing Authorization (CWE-862)

2026-06-09 contact@wpscan.com

GHSA-xjpm-62p5-jw4j

Authentication Bypass WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 14:27 vuln.today

CVSS changed

Jun 09, 2026 - 14:22 NVD

5.3 (MEDIUM)

Patch available

Jun 09, 2026 - 08:01 EUVD

CVE Published

Jun 09, 2026 - 06:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 06:16 nvd

MEDIUM 5.3

DescriptionCVE.org

The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before processing them, allowing unauthenticated attackers to forge webhook payloads and manipulate the payment state of arbitrary transactions.

AnalysisAI

WPForms WordPress plugin versions prior to 1.10.0.5 allow unauthenticated remote attackers to forge PayPal webhook payloads and manipulate the payment state of arbitrary transactions due to absent webhook authenticity verification. The endpoint blindly processes incoming PayPal webhook events without validating their origin or integrity, enabling attackers to mark pending or failed payments as completed. No public exploit has been identified at time of analysis, and EPSS at 0.02% (7th percentile) reflects low current exploitation activity, though the business impact of fraudulent payment confirmation can materially exceed what the CVSS integrity score suggests.

Technical ContextAI

WPForms is a widely deployed WordPress form builder plugin that integrates with PayPal for payment collection. PayPal's webhook system sends event notifications (e.g., payment completed, payment reversed) to a registered endpoint on the merchant's server. Legitimate implementations are required to verify incoming webhook events against a shared secret or PayPal's certificate-based signing mechanism before acting on them. The affected versions (1.10.0.1 through 1.10.0.4) fail to perform this verification, directly processing webhook payloads as trusted. This maps to CWE-862 (Missing Authorization) - the software does not perform an access control check to confirm that the request originates from a legitimate, authorized source (PayPal's servers) before executing a privileged state change on transaction records. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the endpoint is network-reachable with no authentication and no user interaction required.

RemediationAI

Update WPForms to version 1.10.0.5 or later, which introduces proper verification of PayPal webhook event authenticity. This is the only confirmed fix; the patch is available from the vendor per advisory data. Site administrators should update immediately via the WordPress plugin dashboard or wp-cli. As a compensating control prior to patching, operators can temporarily disable the WPForms PayPal integration to prevent the vulnerable webhook endpoint from processing requests - note this will suspend PayPal-based payment collection entirely. Restricting access to the webhook URL via WAF or server-level rules to PayPal's published IP ranges is an additional mitigation, though IP allowlisting requires ongoing maintenance as PayPal's ranges may change. Advisory references: WPScan (https://wpscan.com/vulnerability/1d99eed6-9a16-4d5a-90f9-ab604dfd5b92/) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-4986).