CVE-2026-82844 in WPForms Lite Plugin
Summary
by MITRE • 10/14/2026
The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its notification emails are sent even though no order exists at the payment provider and no payment is recorded.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in WPForms Lite prior to version 2.0.2.2 represents a critical business logic flaw within the plugin’s integration with the PayPal Commerce payment gateway. This issue stems from an insufficient server-side validation mechanism that fails to verify the actual completion of a financial transaction before processing form submissions. In standard secure implementations, when a user initiates a payment through a third-party processor like PayPal, the application must wait for and validate a callback or webhook confirming that funds have been successfully transferred and captured in the merchant's account. However, this specific vulnerability allows the system to bypass these essential checks, treating any submission attempt as valid regardless of whether the associated financial transaction was actually completed by the user.
From a technical perspective, the flaw lies in the absence of state verification between the payment provider and the WordPress application backend. When an unauthenticated visitor interacts with a form configured for PayPal Commerce payments, the plugin accepts the submission data without querying the payment gateway to confirm that an order exists or that funds have been received. This lack of synchronization means that the confirmation page is displayed to the user, and administrative notification emails are triggered as if the transaction were successful. Consequently, no record of the order appears in the PayPal merchant dashboard, nor is any payment recorded within the WordPress environment, creating a significant discrepancy between the perceived state of the system and its actual financial status.
The operational impact of this vulnerability is severe for website owners who rely on WPForms Lite to collect payments or gate access to premium content based on successful transactions. Unauthenticated attackers can exploit this flaw to submit forms without incurring any cost, effectively bypassing paywalls or payment requirements entirely. This leads directly to financial loss through unpaid services and potential abuse of resources such as email notifications, which may be exploited for spamming purposes if the notification settings are not carefully configured. Furthermore, it undermines trust in the integrity of data collected through these forms, as submissions cannot be reliably linked to verified payments.
This vulnerability aligns with CWE-347, Improper Verification of Cryptographic Signature, although in this context, the verification failure pertains more broadly to business logic and transaction state rather than just cryptographic signatures. It also relates to CWE-862, Missing Authorization Check, as the system fails to enforce proper authorization based on payment status before granting access or processing data. In terms of MITRE ATT&CK mapping, this behavior facilitates unauthorized resource consumption and can be categorized under techniques that involve exploiting trust relationships between systems, specifically relating to improper validation of inputs from external services.
To mitigate this risk, administrators must upgrade the WPForms Lite plugin to version 2.0.2.2 or later, where these server-side verification checks have been implemented correctly. Until an update is applied, site owners should consider implementing additional security layers such as Web Application Firewalls that can detect and block anomalous submission patterns indicative of payment bypass attempts. It is also advisable to review form configurations to ensure that critical actions are not solely dependent on client-side indicators or unverified server responses from the payment gateway. Regular auditing of transaction logs against submitted forms can help identify any instances where this vulnerability may have been exploited in the past, allowing for appropriate remediation and recovery measures.