CVE-2026-7792

Name of the Vulnerable Software and Affected Versions WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More versions prior to 1.10.0.2

Description The plugin is subject to insufficient verification of data authenticity. The PayPal Commerce webhook endpoint processes unauthenticated JSON webhook payloads without verifying the HMAC-SHA256 webhook signature, which is required to ensure the request originated from PayPal. The system only checks if the event type is whitelisted before sending attacker-controlled resource data to handlers that update payment records. This allows unauthenticated attackers with a valid subscription id to forge PayPal webhook events and modify subscription payment records, such as changing the subscription status to active to reactivate a cancelled or suspended subscription.

Recommendations Update to a version later than 1.10.0.1.