{
 "id": "WPSEC-2026-0642",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0642/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0642/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0642/index.md",
 "title": "Accept PayPal Payments using Contact Form 7 <= 4.0.6 - Unauthenticated Missing Authorization to Payment Data CSV Export",
 "description": "The Accept PayPal Payments using Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the payment submissions CSV export functionality in versions 4.0.0 up to, and including, 4.0.6. This makes it possible for unauthenticated attackers to export stored payment submission records, including transaction IDs, amounts, IP addresses and submitted form data.",
 "plugin": {
  "slug": "contact-form-7-paypal-extension",
  "name": "Accept PayPal Payments using Contact Form 7",
  "full_name": "Accept PayPal Payments using Contact Form 7",
  "wordpress_org": "https://wordpress.org/plugins/contact-form-7-paypal-extension/",
  "advisories_url": "https://wpsec.com/vuln/plugin/contact-form-7-paypal-extension/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/contact-form-7-paypal-extension"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.0.0",
    "from_inclusive": true,
    "to": "4.0.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.0.0 before 4.0.7"
  ]
 },
 "introduced_in": "4.0.0",
 "fixed_in": "4.0.7",
 "remediation": "Update to 4.0.7 or later.",
 "fix_released": "2026-10-07T10:50:21+00:00",
 "published": "2026-10-08T11:45:37+00:00",
 "updated": "2026-10-07T19:15:14.062294+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0642/",
  "https://plugins.svn.wordpress.org/contact-form-7-paypal-extension/tags/4.0.7/",
  "https://wordpress.org/plugins/contact-form-7-paypal-extension/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/contact-form-7-paypal-extension",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-08"
 }
}