# CP Contact Form with Paypal <= 1.3.69 - Unauthenticated Payment Bypass via IPN Handler

- **ID:** WPSEC-2026-1912
- **Plugin:** CP Contact Form with PayPal (`cp-contact-form-with-paypal`), https://wordpress.org/plugins/cp-contact-form-with-paypal/
- **Affected versions:** all versions before 1.3.70
- **Fixed in:** 1.3.70 (Update to 1.3.70 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/cp-contact-form-with-paypal
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1912/

## Description

The CP Contact Form with PayPal plugin for WordPress is vulnerable to payment bypass via the 'cp_contactformpp_ipncheck' IPN handler in all versions up to, and including, 1.3.69, due to the handler selecting the submission by a sequential ID taken from the URL and marking it paid after PayPal confirms the notification, without checking that the payment went to the site's configured merchant account, matched the expected amount and currency, or was bound to that order. This makes it possible for unauthenticated attackers to have their form submissions marked as paid by making a token payment to an account they control.

## References

- https://wpsec.com/vuln/WPSEC-2026-1912/
- https://plugins.svn.wordpress.org/cp-contact-form-with-paypal/tags/1.3.70/
- https://wordpress.org/plugins/cp-contact-form-with-paypal/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1912/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.