CVE-2026-105990: Accept PayPal Payments using Contact Form 7 0 to before 4.0.7

Affected technology

Accept PayPal Payments using Contact Form 7 · 0 to before 4.0.7
Vendor not specified by the source

Description’s affected range: before 4.0.7 does not perform any authorization checks before exporting stored form submissions

Component: Not specified by the source

What an attacker can do

Unauthenticated attackers can download the personal data (name, email, telephone, postal address, message) and payment metadata of everyone who submitted a payment form.