{"id":"CVE-2026-105989","aliases":["EUVD-2026-96123","GHSA-29vq-ff64-7939"],"status":"published","title":"Accept PayPal Payments using Contact Form 7 \u003c 4.0.7 - Unauthenticated Transaction Status Forgery","description":"The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7's status metadata onto arbitrary posts.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00215,"percentile":0.11947,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-10-10T06:00:08Z","modified":"2026-10-13T20:36:00Z","products":[{"vendor":"unknown","product":"accept paypal payments using contact form 7"},{"vendor":"zealousweb","product":"accept paypal payments using contact form 7"}],"references":[{"url":"https://wpscan.com/vulnerability/df2b15dd-1748-4dcf-8b4f-8c053dc0dd73/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105989"},{"url":"https://wpscan.com/vulnerability/df2b15dd-1748-4dcf-8b4f-8c053dc0dd73"},{"url":"https://github.com/advisories/GHSA-29vq-ff64-7939"}],"sources":{"cve":[{"id":"CVE-2026-105989","title":"Accept PayPal Payments using Contact Form 7 \u003c 4.0.7 - Unauthenticated Transaction Status Forgery","description":"The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7's status metadata onto arbitrary posts.","status":"published","published":"2026-10-10T06:00:08.498Z","modified":"2026-10-10T12:06:42.05Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:19:56.755658Z"}],"euvd":[{"id":"EUVD-2026-96123","description":"The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7's status metadata onto arbitrary posts.","status":"published","published":"2026-10-10T06:00:08Z","modified":"2026-10-10T12:06:42Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:23.685286Z"}],"ghsa":[{"id":"GHSA-29vq-ff64-7939","title":"The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform...","description":"The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7's status metadata onto arbitrary posts.","status":"published","published":"2026-10-10T06:30:59Z","modified":"2026-10-10T12:30:26Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:13:02.546582Z"}],"nvd":[{"id":"CVE-2026-105989","description":"The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7's status metadata onto arbitrary posts.","status":"published","published":"2026-10-10T06:16:40.547Z","modified":"2026-10-13T20:36:00.85Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:55.473789Z"}]}}