Wpforms Lite
Monthly
Payment bypass in WPForms Lite (versions before 2.0.2.2) allows unauthenticated visitors to submit forms that are configured to use the plugin's PayPal Commerce gateway without ever completing payment, because the plugin does not perform a server-side check that PayPal recorded a completed order before accepting the submission. The form confirmation is still delivered and notification emails are still sent even though no order exists at the payment provider and no payment is recorded, making this a business-logic integrity flaw (CVSS 5.3, I:L; no confidentiality or availability impact) rather than a system-compromise bug. Exploitation is limited to sites that have enabled the PayPal Commerce gateway on a form - forms using other gateways or no payment at all are out of scope - and while publicly available exploit code exists, there is no indication of confirmed active exploitation (not in CISA KEV).
Payment bypass in WPForms Lite (versions before 2.0.2.2) allows unauthenticated visitors to submit forms that are configured to use the plugin's PayPal Commerce gateway without ever completing payment, because the plugin does not perform a server-side check that PayPal recorded a completed order before accepting the submission. The form confirmation is still delivered and notification emails are still sent even though no order exists at the payment provider and no payment is recorded, making this a business-logic integrity flaw (CVSS 5.3, I:L; no confidentiality or availability impact) rather than a system-compromise bug. Exploitation is limited to sites that have enabled the PayPal Commerce gateway on a form - forms using other gateways or no payment at all are out of scope - and while publicly available exploit code exists, there is no indication of confirmed active exploitation (not in CISA KEV).