CVE-2026-39707
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Accept PayPal Payments using Contact Form 7 extension for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 4.0.4.
Risk Assessment
An attacker can gain unauthorized access to PayPal payment settings, potentially leading to theft of funds or customer data.
Recommendation
Immediately update the extension to the latest version and verify access permissions.
Original NVD description (English source)
Missing Authorization vulnerability in ZealousWeb Accept PayPal Payments using Contact Form 7 contact-form-7-paypal-extension allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accept PayPal Payments using Contact Form 7: from n/a through <= 4.0.4.