CVE-2026-7792: WPForms PayPal Webhook Forgery Vulnerability – Subscription Fraud Risk

Technical summary

CVE-2026-7792 is an insufficient data authenticity verification flaw in the WPForms PayPal Commerce webhook handler (affecting versions up to 1.10.0.1). The vulnerable endpoint processes incoming JSON webhooks without validating the HMAC-SHA256 signature that PayPal appends to legitimate requests. Instead, the code performs only a whitelist check on the event_type field before passing attacker-supplied resource data to payment record handlers. This allows an unauthenticated threat actor with knowledge of a valid subscription_id to forge webhook events—such as subscription.updated or payment.capture.completed payloads—and trigger state changes in the plugin's subscription database. The underlying weakness is classified as CWE-345 (Insufficient Verification of Data Authenticity).

Business impact

Organizations running WPForms with PayPal Commerce integration face revenue leakage and customer service disruption. Attackers could reactivate expired or cancelled subscriptions without payment, effectively converting paid subscriptions into free access. This creates revenue loss, potential chargeback disputes, and compliance issues if subscription records diverge from actual payment collection. Additionally, modified payment records may trigger false reconciliation alerts or incorrect financial reporting. Affected sites with high subscription volumes could experience significant operational overhead as teams investigate anomalous payment state changes and manually correct records.

Affected systems

The WPForms – Easy Form Builder for WordPress plugin in versions up to and including 1.10.0.1 is vulnerable. Any WordPress installation using WPForms with the PayPal Commerce payment gateway enabled is potentially at risk. The vulnerability applies regardless of whether the site actively processes subscriptions, since the webhook endpoint is live and accessible once PayPal integration is configured. Verify your installed version in the WordPress plugin dashboard or check the version string in wp-content/plugins/wpforms/wpforms.php.

Exploitability

Exploitability is straightforward for attackers with basic technical knowledge. No authentication, user interaction, or special network access is required. An attacker needs only to identify a valid subscription_id (which may be discoverable through reconnaissance or leaked customer data) and craft an HTTP POST request to the vulnerable webhook endpoint with forged JSON payload and a spoofed event_type. The attack surface is network-wide and unauthenticated, reflected in the CVSS score of 5.3 (MEDIUM, vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). However, the impact is limited to integrity of payment records; no data confidentiality or service availability is directly compromised. The vulnerability is not yet tracked in the CISA Known Exploited Vulnerabilities catalog, but the simplicity of exploitation means defensive action should not be delayed pending public proof-of-concept.

Remediation

Update WPForms to a version that implements proper HMAC-SHA256 webhook signature verification. The plugin maintainers have been notified and should release a patched version; check the official WPForms plugin page or your WordPress admin dashboard for available updates. In addition to updating, verify that PayPal webhook events are being validated against the webhook signing secret configured in your PayPal account settings. If you cannot update immediately, consider temporarily disabling PayPal Commerce integration or restricting webhook endpoint access via Web Application Firewall rules that validate incoming request signatures before they reach the plugin.

Patch guidance

Apply updates as soon as they become available through the WordPress plugin management interface. After updating, conduct a manual audit of recent subscription state changes (reactivations, status modifications) in your payment records to identify any unauthorized alterations that may have occurred while the vulnerability was present. Cross-reference suspicious changes against actual PayPal transaction logs and customer communication records. If your site processes high-volume subscriptions, consider monitoring webhook processing logs for unusual event patterns (e.g., multiple subscription reactivations from the same IP or within short timeframes) that may indicate exploitation attempts.

Detection guidance

Monitor your web server and WordPress logs for POST requests to the WPForms PayPal Commerce webhook endpoint. Look for requests that contain subscription.updated or payment.capture.completed events with subscription_status field values that differ from what PayPal's API reports for that subscription_id. Implement webhook signature validation at the Web Application Firewall layer if possible to drop unsigned or invalidly signed requests before they reach the application. Check your PayPal account's webhook event logs to compare legitimate webhook timestamps and event ordering against your WordPress payment records; gaps or inconsistencies may indicate forged events. Consider enabling additional audit logging in WPForms or via a WordPress security plugin to track all subscription state changes and their originating source.

Why prioritize this

Although the CVSS score is MEDIUM (5.3), this vulnerability warrants priority patching because it directly enables revenue fraud with no attacker authentication, low technical complexity, and clear business impact for any organization operating subscription services. The attack surface is the public-facing webhook endpoint, and the adversary only needs a valid subscription identifier to begin exploitation. The lack of signature verification is a fundamental control failure rather than an edge-case logic flaw. Organizations with mature subscription billing operations should treat this as a high-priority remediation target.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects an unauthenticated network attack with low complexity and a focus on integrity impact (modification of payment records). The score does not account for business context: for a subscription-based service, the ability to forge payment events is a critical revenue control failure. The lack of CIA confidentiality or availability impact limits the numeric score, but the functional impact (fraudulent subscription reactivation) is substantial. Security teams should consider this a higher operational priority than the numeric CVSS suggests, especially for organizations dependent on recurring billing.

Frequently asked questions