CVE-2026-105989: Unknown Accept PayPal Payments Using Contact Form 7

Medium severity, CVSS 5.3. EPSS: 0.1% chance of exploitation in the next 30 days.

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7's status metadata onto arbitrary posts.

Affected products

• Unknown Accept PayPal Payments Using Contact Form 7: before 4.0.7 (fixed in 4.0.7)

Published 2026-10-10. Last modified 2026-10-10.