PT-2026-109515 · WordPress · Accept Sagepay Payments Using Contact Form 7
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Accept PayPal Payments using Contact Form 7 versions prior to 4.0.7
Description
The plugin fails to perform authorization checks before exporting stored form submissions. This allows unauthenticated attackers to download payment metadata and personal identifiable information (PII), including names, emails, telephone numbers, postal addresses, and messages, from all users who submitted a payment form.
Recommendations
Update Accept PayPal Payments using Contact Form 7 to version 4.0.7 or later.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Accept Sagepay Payments Using Contact Form 7