What is the CVSS score of CVE-2026-66660?

CVE-2026-66660 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

CF7 PayPal Add-on CVE-2026-66660

EUVD-2026-57898 MEDIUM

Missing Authorization (CWE-862)

2026-08-13 Patchstack

GHSA-94fv-c543-8j9g

WordPress Authentication Bypass Wordpress Plugin Contact Form 7 Paypal Stripe Add On Scott Paterson

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable with no credentials per CWE-862 missing auth check; scope unchanged, no described data exposure, only limited plugin-state modification and availability disruption.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:13 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Contact Form 7 - PayPal & Stripe Add-on <= 2.5.1 versions.

AnalysisAI

Broken access control in Contact Form 7 - PayPal & Stripe Add-on versions 2.5.1 and below allows unauthenticated remote attackers to invoke privileged plugin functionality without authorization, enabling unauthorized modification of plugin state or disruption of payment form behavior. Discovered and disclosed by Patchstack (ENISA EUVD-2026-57898), the flaw is rooted in CWE-862 (Missing Authorization), meaning one or more plugin endpoints or AJAX handlers execute sensitive actions without verifying caller permissions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Technical ContextAI

The affected product is a WordPress plugin that extends Contact Form 7 to integrate PayPal and Stripe payment processing, authored by Scott Paterson (CPE: cpe:2.3:a:scott_paterson:contact_form_7_-_paypal_&_stripe_add-on:*:*:*:*:*:*:*:*). CWE-862 (Missing Authorization) describes a root cause where code performs a sensitive action - such as modifying plugin settings, processing payment configuration, or triggering form operations - without verifying that the caller holds the required capability. In the WordPress plugin ecosystem, authorization must be implemented manually by developers, typically via current_user_can() checks on REST API endpoints or wp_ajax_ handlers; the framework does not enforce these automatically. The payment processing context makes this class of flaw particularly notable, as unprotected endpoints may touch API key storage, webhook configuration, or payment gateway settings, even if the current CVSS impact metrics (I:L, A:L, C:N) suggest only limited consequences.

RemediationAI

Patch available per vendor advisory - administrators should update the Contact Form 7 - PayPal & Stripe Add-on to the latest available version via the WordPress plugin repository or the author's official channel; no exact fixed version number was present in the available intelligence and should be verified directly against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/contact-form-7-paypal-add-on/vulnerability/wordpress-contact-form-7-paypal-stripe-add-on-plugin-2-5-1-broken-access-control-vulnerability. For sites unable to patch immediately, restricting access to WordPress admin-area AJAX and REST API endpoints via a WAF or reverse-proxy IP allowlist is a viable compensating control, though it may interfere with legitimate front-end form submissions that rely on those endpoints. Disabling the plugin entirely on sites where active payment processing is not occurring is a low-impact interim measure with the trade-off of removing payment form capability until the patch is applied.