CVE-2026-9189
Payment Bypass in Contact Form 7 PayPal Stripe Add-on
Publication date: 2026-05-29
Last updated on: 2026-05-29
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| contact_form_7_paypal_stripe_add_on | 2.4.9 | to 2.4.9 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-345 | The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthenticated attackers to mark high-value pending orders as fully paid without tendering the required payment amount by exploiting insufficient verification of payment data.
Such unauthorized payment bypass could lead to financial discrepancies and potential fraudulent transactions, which may impact compliance with standards and regulations that require accurate transaction records and fraud prevention, such as PCI DSS.
However, there is no direct information provided about its impact on data privacy regulations like GDPR or HIPAA in the provided context.
Can you explain this vulnerability to me?
The Contact Form 7 – PayPal & Stripe Add-on plugin for WordPress has a vulnerability that allows attackers to bypass payment verification. Although the plugin validates the authenticity of PayPal IPN messages, it does not verify critical payment details such as the payment amount, currency, or receiver email against stored order information. Attackers can exploit this by sending a crafted IPN with a manipulated invoice field, causing the system to mark high-value pending orders as paid without receiving the full payment.
How can this vulnerability impact me? :
This vulnerability can allow unauthenticated attackers to fraudulently complete purchases by marking orders as paid without actually tendering the required payment amount. This can lead to financial losses, unauthorized access to goods or services, and potential disruption of business operations.