# CP Contact Form with Paypal <= 1.3.69 - Unauthenticated Payment Bypass via 'paypal_rest_transaction_id' Parameter

- **ID:** WPSEC-2026-1911
- **Plugin:** CP Contact Form with PayPal (`cp-contact-form-with-paypal`), https://wordpress.org/plugins/cp-contact-form-with-paypal/
- **Affected versions:** from 1.3.63 before 1.3.70
- **Fixed in:** 1.3.70 (Update to 1.3.70 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/cp-contact-form-with-paypal
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1911/

## Description

The CP Contact Form with PayPal plugin for WordPress is vulnerable to payment bypass via the 'paypal_rest_transaction_id' parameter of the public form submission in versions 1.3.63 up to, and including, 1.3.69, due to the plugin trusting a client-supplied PayPal REST transaction ID and marking the submission as paid without confirming the transaction, its amount or its currency with PayPal. This makes it possible for unauthenticated attackers to have form submissions marked as paid and processed without completing a payment.

## References

- https://wpsec.com/vuln/WPSEC-2026-1911/
- https://plugins.svn.wordpress.org/cp-contact-form-with-paypal/tags/1.3.70/
- https://wordpress.org/plugins/cp-contact-form-with-paypal/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1911/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.