EUVD-2026-96124
GHSA-gg38-hc35-5qm5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable plugin
-
ExploitRequest unauthenticated export endpoint
-
ExecutionMissing authorization check bypassed
-
ImpactDownload all submitters' PII and payment metadata
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - the plugin's stored-submission export routine performs no authorization check, so remote unauthenticated exploitation works against default configurations of the Accept PayPal Payments using Contact Form 7 plugin in all versions before 4.0.7. The only practical limiters are that the target site must have this specific plugin installed and must have stored form submissions for any data to be disclosed; there is no user interaction, authentication, or non-default setting required. |
| Impact | Signals are moderate but one-sided. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N = 5.3) confirms a remotely reachable, unauthenticated, low-complexity information-disclosure flaw with no integrity or availability impact. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or at-scale exploitation at this time - exploitation status is 'no public exploit identified at time of analysis.' The one point of tension is the confidentiality rating: NVD scores C:L, but the description says the flaw dumps the complete personal data (name, email, telephone, postal address, message) and payment metadata of every form submitter, which is a bulk PII breach that many analysts would rate C:H - this drives my independent assessment higher (7.5). Net: this is a credible, low-friction data-exposure bug worth prompt patching for any site running the affected plugin, but absent EPSS/KEV/POC it is not an emergency on the scale of a mass-exploited RCE. The main unknown is real-world install footprint, which the provided data does not quantify. |
| Exploit ScenarioDerived | An unauthenticated attacker discovers a WordPress site running the vulnerable plugin and sends a request to its submission-export function, which performs no authorization check. The server returns a file containing the personal details and payment metadata of everyone who ever submitted the payment form. No public exploit code was provided, but given AV:N/AC:L/PR:N the request is trivial to craft and automate. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated information disclosure in the WordPress plugin 'Accept PayPal Payments using Contact Form 7' (all versions before 4.0.7) allows any remote visitor to download the stored form submissions - name, email, telephone, postal address, message and associated payment metadata - of every person who submitted a payment form. The plugin's export routine performs no authorization check whatsoever, so exploitation requires no account, no user interaction and no non-default configuration; the only practical preconditions are that the plugin is installed and that at least one submission has been stored. Our independent assessment rates confidentiality impact as High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) rather than the feed-supplied C:L, and no public exploit code or confirmed active exploitation has been identified at time of analysis; a vendor fix is available in version 4.0.7.
RemediationAI
Vendor-released patch: version 4.0.7 - upgrade the 'Accept PayPal Payments using Contact Form 7' plugin to 4.0.7 or later immediately, and verify the installed version via wp-cli ('wp plugin list') or the WordPress Plugins screen; details are in the WPScan advisory at https://wpscan.com/vulnerability/211d7613-a7e0-45f9-b262-66651aa4f535/. If the plugin cannot be patched promptly, deactivate and delete it (trade-off: payment form functionality is lost, but stored data remains in the database and is no longer servable by the vulnerable code); purge or archive existing stored submissions and payment metadata after export, since the vulnerability concerns data already at rest. Additional compensating controls - blocking or restricting access to the plugin's export/download handler at the web server or WAF, and adding authentication to any remaining export path - reduce exposure but are brittle because they depend on correctly enumerating every entry point the plugin registers, and they can break legitimate administrator exports. Because exploitation is unauthenticated and passive data retrieval leaves limited forensic traces, treat any period of unpatched exposure as a potential breach: review access logs for requests to plugin export endpoints and be prepared to notify affected submitters given the PII and payment metadata involved. No patch unavailability applies here; there is no need for purely mitigative measures on patched sites.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is a WordPress plugin that extends Contact Form 7 to accept and process PayPal payments, persisting each submission together with payment metadata in the site's database. The root cause maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the export/download routine that serves stored submissions lacks any capability or authorization verification - in WordPress terms, an endpoint reachable without a current_user_can() capability check (and typically without a nonce), so requests from unauthenticated visitors are served the same data an administrator would see. Because WordPress exposes such handlers through publicly reachable entry points (admin-ajax.php/admin-post.php style handlers or a direct download script), the missing check converts an administrative data-export feature into an open endpoint. The affected version range given by ENISA (EUVD-2026-96124) is 0 < 4.0.7; no CPE strings were supplied in the feeds, so product identification should be performed via WordPress plugin/theme inventory (WPScan, wp-cli plugin list) rather than CPE matching. The impact class is pure confidentiality loss - no integrity or availability effect - which is why the vector is S:U/I:N/A:N with the confidentiality metric the sole point of contention between the feed (C:L) and our assessment (C:H), the latter reflecting that wholesale PII and payment metadata of all submitters is disclosed.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network request dumps the complete PII and payment dataset of all submitters, justifying C:H; no integrity or availability impact and no scope change.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
4DescriptionCVE.org
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data (name, email, telephone, postal address, message) and payment metadata of everyone who submitted a payment form.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Exploit-DB