Vulnerabilities / CP Contact Form with Paypal / WPSEC-2026-1911
CP Contact Form with Paypal <= 1.3.69 - Unauthenticated Payment Bypass via 'paypal_rest_transaction_id' Parameter
Medium 5.3
CWE-345Fixed in 1.3.70
- ID
- WPSEC-2026-1911
- Plugin
- CP Contact Form with PayPal (cp-contact-form-with-paypal)
- Affected
- from 1.3.63 before 1.3.70
- Remediation
- Update to 1.3.70 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-29
- Attack surface
- CP Contact Form with Paypal on WPSec AttackSurface
- Fix released
- Published
Description
The CP Contact Form with PayPal plugin for WordPress is vulnerable to payment bypass via the 'paypal_rest_transaction_id' parameter of the public form submission in versions 1.3.63 up to, and including, 1.3.69, due to the plugin trusting a client-supplied PayPal REST transaction ID and marking the submission as paid without confirming the transaction, its amount or its currency with PayPal. This makes it possible for unauthenticated attackers to have form submissions marked as paid and processed without completing a payment.
References
- https://wpsec.com/vuln/WPSEC-2026-1911/
- https://plugins.svn.wordpress.org/cp-contact-form-with-paypal/tags/1.3.70/
- https://wordpress.org/plugins/cp-contact-form-with-paypal/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS