CVE-2026-4986

WPForms Lite < 1.10.0.5 – Unauthenticated PayPal Webhook Forgery

Medium · published June 9, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
24.9
In the wild
Unconfirmed
What it is

The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before processing them, allowing unauthenticated attackers to forge webhook payloads and manipulate the payment state of arbitrary transactions.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00330 · 24.9th percentile
Published
2026-06-09T06:00Z
EPSS history
Timeline
  • 09 JUN 06:00Z
    WPForms Lite < 1.10.0.5 – Unauthenticated PayPal Webhook Forgery
    cvelistv5