CVE-2026-82844

Deferred Deferred - Pending Action

WPForms Lite Payment Bypass Vulnerability

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its notification emails are sent even though no order exists at the payment provider and no payment is recorded.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-82844

EUVD

EUVD-2026-100976

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	WPForms	Lite 1.10.0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

This vulnerability affects the WPForms Lite WordPress plugin versions 1.10.0.1 through 2.0.2.1. It allows unauthenticated users to submit paid forms using the PayPal Commerce gateway without completing the payment. The plugin fails to verify server-side if a payment was made, so forms are accepted, confirmations sent, and emails triggered even when no payment is recorded.

Detection Guidance

Check the installed version of the WPForms Lite plugin in your WordPress admin panel. If it is between 1.10.0.1 and 2.0.2.1, the system is vulnerable. Use commands like 'wp plugin list' in WP-CLI or inspect the plugin files for version details.

Impact Analysis

If you use the affected WPForms Lite plugin versions, attackers could submit paid forms without paying, leading to lost revenue, unauthorized access to form data, and potential misuse of your forms. Confirmations and notifications may be sent for non-existent orders.

Compliance Impact

This vulnerability could lead to unauthorized data collection or processing, violating GDPR principles like data minimization and consent. For HIPAA, it may risk exposing protected health information without proper payment verification.

Mitigation Strategies

Update the WPForms Lite plugin to version 2.0.2.2 or later immediately. Disable forms using the PayPal Commerce gateway if an update is not possible. Monitor for unauthorized submissions or payments.

Hi! I’m here to help you understand CVE-2026-82844. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70