CVE-2026-105990
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data (name, email, telephone, postal address, message) and payment metadata of everyone who submitted a payment form.
Risk Assessment
An attacker can download sensitive customer personal data and payment information, potentially leading to privacy breaches, identity theft, or financial fraud.
Recommendation
Update the Accept PayPal Payments using Contact Form 7 plugin to version 4.0.7 or later, which includes the security fix.
Other vulnerabilities in Accept PayPal Payments using Contact Form 7
See all- CVE-2026-105989Medium
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the plugin's status metadata onto arbitrary posts.
- CVE-2026-39707Medium
The Accept PayPal Payments using Contact Form 7 extension for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 4.0.4.
Original NVD description (English source)
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data (name, email, telephone, postal address, message) and payment metadata of everyone who submitted a payment form.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS