WordPress security changelog
MEDIUM CVE-2026-9189 Deferred

Contact Form 7 – PayPal & Stripe Add-on: A security weakness

Contact Form 7 – PayPal & Stripe Add-on is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 2.4.9.

CVE / CNA score 5.3 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Contact Form 7 – PayPal & Stripe Add-on
Plugin slug
contact-form-7-paypal-add-on
Affected
<= 2.4.9
Safe version
> 2.4.9
Published
May 29, 2026
Weakness
CWE-345 — Insufficient Verification of Data Authenticity

This CVE was published May 29, 2026 and is one of 7 known issues for this plugin.

What to do

Update, patch or deactivate.

Update Contact Form 7 – PayPal & Stripe Add-on to a release after 2.4.9, or disable and remove it until a fixed version is available.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Contact Form 7 – PayPal & Stripe Add-on plugin for WordPress is vulnerable to Payment Bypass via Insufficient Verification of Data Authenticity in all versions up to, and including, 2.4.9. Although `cf7pp_paypal_ipn_handler()` correctly validates IPN authenticity by posting back to PayPal with `cmd=_notify-validate`, it fails to compare the IPN payload's `mc_gross` (payment amount), `mc_currency`, or `receiver_email` fields against the corresponding stored order values before passing the attacker-controlled `invoice` field directly to `cf7pp_complete_payment()`, which marks the order completed after only an integer cast with no amount verification. This makes it possible for unauthenticated attackers to mark arbitrary high-value pending orders as fully paid by making a minimal real PayPal payment and crafting an IPN whose `invoice` parameter references the targeted order, effectively completing purchases without tendering the required payment amount.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

Primary and upstream sources