{"id":"CVE-2026-9189","aliases":["EUVD-2026-33265","GHSA-vr4h-g9wj-2p4g"],"status":"published","title":"Contact Form 7 – PayPal \u0026 Stripe Add-on \u003c= 2.4.9 - Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler ('invoice'/'mc_gross' Verification)","description":"The Contact Form 7 – PayPal \u0026 Stripe Add-on plugin for WordPress is vulnerable to Payment Bypass via Insufficient Verification of Data Authenticity in all versions up to, and including, 2.4.9. Although `cf7pp_paypal_ipn_handler()` correctly validates IPN authenticity by posting back to PayPal with `cmd=_notify-validate`, it fails to compare the IPN payload's `mc_gross` (payment amount), `mc_currency`, or `receiver_email` fields against the corresponding stored order values before passing the attacker-controlled `invoice` field directly to `cf7pp_complete_payment()`, which marks the order completed after only an integer cast with no amount verification. This makes it possible for unauthenticated attackers to mark arbitrary high-value pending orders as fully paid by making a minimal real PayPal payment and crafting an IPN whose `invoice` parameter references the targeted order, effectively completing purchases without tendering the required payment amount.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00204,"percentile":0.10508,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-345"],"published":"2026-05-29T08:28:24Z","modified":"2026-07-21T12:10:00Z","products":[{"vendor":"scott paterson","product":"contact form 7 – paypal \u0026 stripe add-on"},{"vendor":"scottpaterson","product":"contact form 7 – paypal \u0026 stripe add-on"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e274781-1c20-4224-bc10-26dadb9b1e07?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/contact-form-7-paypal-add-on/tags/2.4.8/includes/payments/paypal_handler.php#L106"},{"url":"https://plugins.trac.wordpress.org/browser/contact-form-7-paypal-add-on/tags/2.4.8/includes/payments/paypal_handler.php#L75"},{"url":"https://plugins.trac.wordpress.org/browser/contact-form-7-paypal-add-on/tags/2.4.8/includes/payments/functions.php#L31"},{"url":"https://plugins.trac.wordpress.org/browser/contact-form-7-paypal-add-on/tags/2.4.6/includes/payments/paypal_handler.php#L106"},{"url":"https://plugins.trac.wordpress.org/browser/contact-form-7-paypal-add-on/tags/2.4.6/includes/payments/paypal_handler.php#L75"},{"url":"https://plugins.trac.wordpress.org/browser/contact-form-7-paypal-add-on/tags/2.4.6/includes/payments/functions.php#L31"},{"url":"https://plugins.trac.wordpress.org/changeset/3551197/contact-form-7-paypal-add-on"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9189"},{"url":"https://github.com/advisories/GHSA-vr4h-g9wj-2p4g"}],"sources":{"cve":[{"id":"CVE-2026-9189","title":"Contact Form 7 – PayPal \u0026 Stripe Add-on \u003c= 2.4.9 - Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler ('invoice'/'mc_gross' Verification)","description":"The Contact Form 7 – PayPal \u0026 Stripe Add-on plugin for WordPress is vulnerable to Payment Bypass via Insufficient Verification of Data Authenticity in all versions up to, and including, 2.4.9. Although `cf7pp_paypal_ipn_handler()` correctly validates IPN authenticity by posting back to PayPal with `cmd=_notify-validate`, it fails to compare the IPN payload's `mc_gross` (payment amount), `mc_currency`, or `receiver_email` fields against the corresponding stored order values before passing the attacker-controlled `invoice` field directly to `cf7pp_complete_payment()`, which marks the order completed after only an integer cast with no amount verification. This makes it possible for unauthenticated attackers to mark arbitrary high-value pending orders as fully paid by making a minimal real PayPal payment and crafting an IPN whose `invoice` parameter references the targeted order, effectively completing purchases without tendering the required payment amount.","status":"published","published":"2026-05-29T08:28:24.446Z","modified":"2026-05-29T10:04:53.551Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T13:42:26.790871Z"}],"euvd":[{"id":"EUVD-2026-33265","description":"The Contact Form 7 – PayPal \u0026 Stripe Add-on plugin for WordPress is vulnerable to Payment Bypass via Insufficient Verification of Data Authenticity in all versions up to, and including, 2.4.9. Although `cf7pp_paypal_ipn_handler()` correctly validates IPN authenticity by posting back to PayPal with `cmd=_notify-validate`, it fails to compare the IPN payload's `mc_gross` (payment amount), `mc_currency`, or `receiver_email` fields against the corresponding stored order values before passing the attacker-controlled `invoice` field directly to `cf7pp_complete_payment()`, which marks the order completed after only an integer cast with no amount verification. This makes it possible for unauthenticated attackers to mark arbitrary high-value pending orders as fully paid by making a minimal real PayPal payment and crafting an IPN whose `invoice` parameter references the targeted order, effectively completing purchases without tendering the required payment amount.","status":"published","published":"2026-05-29T08:28:24Z","modified":"2026-05-29T10:04:53Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:21:01.680356Z"}],"ghsa":[{"id":"GHSA-vr4h-g9wj-2p4g","title":"The Contact Form 7 – PayPal \u0026 Stripe Add-on plugin for WordPress is vulnerable to Payment Bypass...","description":"The Contact Form 7 – PayPal \u0026 Stripe Add-on plugin for WordPress is vulnerable to Payment Bypass via Insufficient Verification of Data Authenticity in all versions up to, and including, 2.4.9. Although `cf7pp_paypal_ipn_handler()` correctly validates IPN authenticity by posting back to PayPal with `cmd=_notify-validate`, it fails to compare the IPN payload's `mc_gross` (payment amount), `mc_currency`, or `receiver_email` fields against the corresponding stored order values before passing the attacker-controlled `invoice` field directly to `cf7pp_complete_payment()`, which marks the order completed after only an integer cast with no amount verification. This makes it possible for unauthenticated attackers to mark arbitrary high-value pending orders as fully paid by making a minimal real PayPal payment and crafting an IPN whose `invoice` parameter references the targeted order, effectively completing purchases without tendering the required payment amount.","status":"published","published":"2026-05-29T09:31:07Z","modified":"2026-05-29T09:31:17Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T15:08:22.826978Z"}],"nvd":[{"id":"CVE-2026-9189","description":"The Contact Form 7 – PayPal \u0026 Stripe Add-on plugin for WordPress is vulnerable to Payment Bypass via Insufficient Verification of Data Authenticity in all versions up to, and including, 2.4.9. Although `cf7pp_paypal_ipn_handler()` correctly validates IPN authenticity by posting back to PayPal with `cmd=_notify-validate`, it fails to compare the IPN payload's `mc_gross` (payment amount), `mc_currency`, or `receiver_email` fields against the corresponding stored order values before passing the attacker-controlled `invoice` field directly to `cf7pp_complete_payment()`, which marks the order completed after only an integer cast with no amount verification. This makes it possible for unauthenticated attackers to mark arbitrary high-value pending orders as fully paid by making a minimal real PayPal payment and crafting an IPN whose `invoice` parameter references the targeted order, effectively completing purchases without tendering the required payment amount.","status":"published","published":"2026-05-29T09:16:18.56Z","modified":"2026-07-21T12:10:00.09Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:12:21.244426Z"}]}}