CVE-2026-105990

Name of the Vulnerable Software and Affected Versions Accept PayPal Payments using Contact Form 7 versions prior to 4.0.7

Description The plugin fails to perform authorization checks before exporting stored form submissions. This allows unauthenticated attackers to download payment metadata and personal identifiable information (PII), including names, emails, telephone numbers, postal addresses, and messages, from all users who submitted a payment form.

Recommendations Update Accept PayPal Payments using Contact Form 7 to version 4.0.7 or later.