CVE-2026-105990 in Accept PayPal Payments Using Contact Form 7 Plugin
Summary
by MITRE • 10/10/2026
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data (name, email, telephone, postal address, message) and payment metadata of everyone who submitted a payment form.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified in versions of the Accept PayPal Payments using Contact Form 7 WordPress plugin prior to version 4.0.7 represents a critical failure in access control mechanisms within a widely used e-commerce integration tool for content management systems. This flaw specifically affects the functionality designed to export stored form submissions, which is intended as an administrative feature for site owners to manage customer data and transaction records. The core technical deficiency lies in the absence of any authorization checks or authentication requirements before executing the export operation. In a properly secured application architecture, such sensitive operations must be gated behind strict role-based access control policies that verify the user possesses elevated privileges, typically restricted to administrators. By omitting these verification steps, the plugin exposes an unauthenticated endpoint that can be invoked by any external actor without requiring valid credentials or session tokens.
From a technical perspective, this vulnerability is classified under CWE-284, which describes Improper Access Control, and aligns with ATT&CK technique T1530, Data from Local System, as it involves the exfiltration of data stored on the target server. The attacker can exploit this by sending specific HTTP requests to the plugin's export endpoint, triggering a response that contains a file or stream of data comprising all previously submitted form entries. This includes personally identifiable information such as names, email addresses, telephone numbers, postal addresses, and message content, alongside sensitive payment metadata associated with PayPal transactions. The lack of input validation on the request parameters further facilitates this exploitation, allowing attackers to potentially manipulate export formats or targets if additional logic flaws exist within the broader plugin codebase.
The operational impact of this vulnerability is severe due to the high volume of WordPress sites utilizing Contact Form 7 and its payment extensions for commercial purposes. The exposure of personal data constitutes a direct violation of privacy regulations such as GDPR in Europe, CCPA in California, and other global data protection laws. Organizations affected by this flaw face significant legal liabilities, reputational damage, and potential financial penalties resulting from the breach. Furthermore, the aggregation of contact details and payment histories provides threat actors with valuable intelligence for conducting targeted phishing campaigns, social engineering attacks, or credential stuffing attempts against victims whose information has been compromised. The ease of exploitation means that automated scanning tools can rapidly identify vulnerable instances across the internet, leading to widespread data breaches even on sites where administrators may not be actively monitoring server logs.
Mitigation strategies must prioritize immediate remediation through software updates and defensive configuration changes. Site administrators should upgrade the Accept PayPal Payments using Contact Form 7 plugin to version 4.0.7 or later, as this release addresses the authorization gap by implementing proper access control checks that restrict export functionality to authenticated users with administrative privileges. In environments where updating is not immediately feasible due to compatibility concerns, temporary mitigations include restricting access to WordPress admin endpoints via IP whitelisting in web server configurations and ensuring that any custom code or third-party integrations do not inadvertently expose internal plugin functions through REST API misconfigurations. Additionally, implementing a Web Application Firewall with rules targeting known exploitation patterns for this specific vulnerability can provide an additional layer of defense by blocking unauthorized requests to the export endpoints before they reach the application logic. Regular security audits and penetration testing are recommended to identify similar access control deficiencies in other plugins or custom code within the WordPress ecosystem.