CVE-2026-4986mediumCWE-862

CVE-2026-4986: medium-severity vulnerability in WPForms

WPForms Lite < 1.10.0.5 – Unauthenticated PayPal Webhook Forgery

Published

Follow this CVE+ Monitor WPForms

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.2%
The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before processing them, allowing unauthenticated attackers to forge webhook payloads and manipulate the payment state of arbitrary transactions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · WPForms
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — WPForms

In the same product, most dangerous first.

CVE-2024-11223MEDIUMWPForms < 1.9.2.3 - Admin+ Stored XSSEPSS 0.5%CVE-2024-7056LOWWPForms < 1.9.1.6 - Admin+ Stored XSSEPSS 0.4%CVE-2026-84744MEDIUMWPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field RepopulationEPSS 0.2%CVE-2026-74991MEDIUMWPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntentEPSS 0.2%