CVE-2026-105989: Accept PayPal Payments using Contact Form 7 0 to before 4.0.7

Affected technology

Accept PayPal Payments using Contact Form 7 · 0 to before 4.0.7
Vendor not specified by the source

Description’s affected range: before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions

Component: Not specified by the source

What an attacker can do

Unauthenticated attackers can forge the stored transaction status of records and to write the Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7's status metadata onto arbitrary posts.