EUVD-2026-100976
GHSA-26m8-vxph-vrjq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate WPForms form using PayPal Commerce gateway
-
ExploitSubmit form while skipping/forging payment step
-
ExecutionServer accepts submission without payment verification
-
ImpactConfirmation shown and notification emails sent, no order recorded
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Data authenticity verification
|
| Exploitation Conditions | Exploitable only on sites where a WPForms (Lite before 2.0.2.2) form is configured to use the PayPal Commerce payment gateway; the vulnerable path is the missing server-side confirmation that PayPal recorded a completed payment before accepting the submission. No authentication, user interaction, or special privileges are required (PR:N/UI:N) and default form processing is affected once the PayPal Commerce gateway is enabled, but forms NOT using PayPal Commerce (e.g., unpaid forms or other gateways) are out of scope - the gateway configuration is the key limiting factor. |
| Impact | This is a business-logic payment-bypass flaw, not a system-compromise vulnerability, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3 Medium) reflects remote, unauthenticated, low-complexity exploitation with only a limited integrity impact (C:N, A:N) - matching a description where an attacker forges a completed-payment state rather than reads data or disrupts service. Public exploit code exists (reported by WPScan), but the CVE is NOT in CISA KEV and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation - POC availability alone does not imply in-the-wild use. Real-world priority is moderate and highly conditional: it only matters for sites that actually sell via the WPForms PayPal Commerce gateway, where the financial/fraud impact can be significant despite the modest CVSS. Note a labeling inconsistency: the input Tags mark this 'Information Disclosure', but the description describes a payment/authorization-verification bypass with no data disclosure - treat the info-disclosure characterization with skepticism. EPSS and KEV data are absent/negative, so exploitation likelihood cannot be quantified beyond 'POC public'. |
| Exploit ScenarioDerived | An attacker targets a WordPress site running a WPForms form wired to the PayPal Commerce gateway (e.g., a paid order, donation, or registration form). They submit the form directly without completing payment at PayPal, and because the server never confirms a real order/payment server-side, the submission is accepted - triggering the confirmation page and notification emails as if paid. Public exploit code exists (WPScan), and the CVSS AV:N/AC:L/PR:N/UI:N vector means this can be done remotely and unauthenticated with trivial effort. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Payment bypass in WPForms Lite (versions before 2.0.2.2) allows unauthenticated visitors to submit forms that are configured to use the plugin's PayPal Commerce gateway without ever completing payment, because the plugin does not perform a server-side check that PayPal recorded a completed order before accepting the submission. The form confirmation is still delivered and notification emails are still sent even though no order exists at the payment provider and no payment is recorded, making this a business-logic integrity flaw (CVSS 5.3, I:L; no confidentiality or availability impact) rather than a system-compromise bug. Exploitation is limited to sites that have enabled the PayPal Commerce gateway on a form - forms using other gateways or no payment at all are out of scope - and while publicly available exploit code exists, there is no indication of confirmed active exploitation (not in CISA KEV).
RemediationAI
Apply the vendor-released patch by upgrading WPForms Lite to version 2.0.2.2 or later; this is the only complete fix, since the missing server-side PayPal payment confirmation is corrected in the plugin code itself and the advisory at https://wpscan.com/vulnerability/e959ddad-8588-4136-8518-6b1d772a62c4/ documents the affected range as everything before 2.0.2.2. If the upgrade cannot be staged immediately, the most effective compensating control is to disable the PayPal Commerce gateway on all forms (WPForms > Settings > Payments) or switch affected forms to a gateway whose flow performs its own server-side settlement check - the trade-off is that paid forms stop accepting payments until a patched gateway is reinstated, and any other gateway must be independently validated as performing server-side verification. As a secondary mitigation, gate submission processing behind manual review, treating every PayPal Commerce submission as unpaid until an administrator reconciles it against the PayPal account's transaction records and approves it; this preserves revenue integrity but adds per-submission administrative overhead and delays confirmation emails to legitimate customers. Because exploit code is publicly available and no authentication or user interaction is required (CVSS PR:N/UI:N), sites that cannot patch promptly should also monitor WordPress form-entry logs and outbound notification mail for submissions with no matching PayPal order so that fraudulent or unpaid submissions can be identified and cancelled. Note that the standard WordPress/WAF defenses - rate limiting, bot filtering, and generic input sanitization - do not address this business-logic bypass, because the request that reaches the vulnerable path is otherwise well-formed and legitimate-looking.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WPForms Lite is a widely deployed WordPress form-builder plugin that integrates third-party payment gateways, including PayPal Commerce, to sell paid form submissions. In a correctly implemented gateway flow, the plugin must confirm with the payment provider - typically via a server-to-server order capture, webhook, or IPN callback - that a transaction actually completed before marking the submission as paid and releasing the confirmation page and notification emails. CVE-2026-82844 is the absence of that server-side confirmation step: the plugin trusts the client-side return from the gateway without verifying the corresponding order state at PayPal, so the submission-processing path proceeds as if payment succeeded. The supplied data assigns no CWE (CWE: N/A), but the flaw falls into the classic business-logic / missing server-side enforcement class (client-side enforcement of a server-side security decision, improper enforcement of a workflow). The CPE entry cpe:2.3:a:unknown:wpforms_lite:*:*:*:*:*:*:*:* uses a wildcard version and an unpopulated vendor field, so it does not itself narrow the affected range - the version constraint comes from the advisory, which covers WPForms Lite before 2.0.2.2. No authentication, user interaction, or elevated privilege is needed per the CVSS vector (AV:N/AC:L/PR:N/UI:N), and the only modified metric is integrity (I:L), which matches a payment-state bypass that does not expose data or disrupt availability.
Know when Wpforms Lite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Remote unauthenticated submission with no UI (AV:N/AC:L/PR:N/UI:N); only integrity is affected by forging paid state (I:L), with no data disclosure or availability loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
2DescriptionCVE.org
The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its notification emails are sent even though no order exists at the payment provider and no payment is recorded.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB