{
 "id": "WPSEC-2026-1912",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1912/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1912/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1912/index.md",
 "title": "CP Contact Form with Paypal <= 1.3.69 - Unauthenticated Payment Bypass via IPN Handler",
 "description": "The CP Contact Form with PayPal plugin for WordPress is vulnerable to payment bypass via the 'cp_contactformpp_ipncheck' IPN handler in all versions up to, and including, 1.3.69, due to the handler selecting the submission by a sequential ID taken from the URL and marking it paid after PayPal confirms the notification, without checking that the payment went to the site's configured merchant account, matched the expected amount and currency, or was bound to that order. This makes it possible for unauthenticated attackers to have their form submissions marked as paid by making a token payment to an account they control.",
 "plugin": {
  "slug": "cp-contact-form-with-paypal",
  "name": "CP Contact Form with Paypal",
  "full_name": "CP Contact Form with PayPal",
  "wordpress_org": "https://wordpress.org/plugins/cp-contact-form-with-paypal/",
  "advisories_url": "https://wpsec.com/vuln/plugin/cp-contact-form-with-paypal/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/cp-contact-form-with-paypal"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.3.70",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.3.70"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.3.70",
 "remediation": "Update to 1.3.70 or later.",
 "fix_released": "2026-10-28T11:26:39+00:00",
 "published": "2026-10-29T18:50:39+00:00",
 "updated": "2026-10-29T17:38:10.058976+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1912/",
  "https://plugins.svn.wordpress.org/cp-contact-form-with-paypal/tags/1.3.70/",
  "https://wordpress.org/plugins/cp-contact-form-with-paypal/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/cp-contact-form-with-paypal",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-29"
 }
}