CVE-2026-105990: medium-severity vulnerability in Accept PayPal Payments using Contact Form 7
Accept PayPal Payments Using Contact Form 7 < 4.0.7 - Unauthenticated PII Disclosure via CSV Export
Published
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.3%
exploitation probability
0.3%top 85% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data (name, email, telephone, postal address, message) and payment metadata of everyone who submitted a payment form.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · Accept PayPal Payments using Contact Form 7public PoCs found — 1
cve_referencewpscan.com/vulnerability/211d7613-a7e0-45f9-b262-66651aa4f535/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Accept PayPal Payments using Contact Form 7
In the same product, most dangerous first.