PT-2026-109514 · WordPress · Accept Sagepay Payments Using Contact Form 7
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Accept PayPal Payments using Contact Form 7 versions prior to 4.0.7
Description
The plugin fails to perform authorization or request-validation checks on an AJAX action. This allows unauthenticated attackers to forge the stored transaction status of records and write status metadata onto arbitrary posts.
Recommendations
Update to version 4.0.7 or later.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Accept Sagepay Payments Using Contact Form 7