CP Contact Form with Paypal <= 1.3.69 - Unauthenticated Payment Bypass via IPN Handler
- ID
- WPSEC-2026-1912
- Plugin
- CP Contact Form with PayPal (cp-contact-form-with-paypal)
- Affected
- all versions before 1.3.70
- Remediation
- Update to 1.3.70 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-29
- Attack surface
- CP Contact Form with Paypal on WPSec AttackSurface
- Fix released
- Published
Description
The CP Contact Form with PayPal plugin for WordPress is vulnerable to payment bypass via the 'cp_contactformpp_ipncheck' IPN handler in all versions up to, and including, 1.3.69, due to the handler selecting the submission by a sequential ID taken from the URL and marking it paid after PayPal confirms the notification, without checking that the payment went to the site's configured merchant account, matched the expected amount and currency, or was bound to that order. This makes it possible for unauthenticated attackers to have their form submissions marked as paid by making a token payment to an account they control.
References
- https://wpsec.com/vuln/WPSEC-2026-1912/
- https://plugins.svn.wordpress.org/cp-contact-form-with-paypal/tags/1.3.70/
- https://wordpress.org/plugins/cp-contact-form-with-paypal/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS