CVE-2026-9189: Contact Form 7 PayPal Add-on Payment Bypass Vulnerability

Technical summary

CVE-2026-9189 exploits insufficient verification in the Contact Form 7 – PayPal & Stripe Add-on's IPN handler. While the plugin correctly validates IPN authenticity by posting back to PayPal's confirmation endpoint, it omits critical post-validation checks: it never compares the IPN payload's mc_gross (amount), mc_currency, or receiver_email fields against stored order values. Instead, the attacker-controlled invoice field is passed directly to cf7pp_complete_payment() after only a type cast, bypassing amount verification. An attacker creates a small legitimate PayPal transaction, intercepts or crafts an IPN message, modifies the invoice parameter to target a pending high-value order, and submits it. The plugin accepts the IPN as authentic and marks the expensive order complete. The vulnerability maps to CWE-345 (Insufficient Verification of Data Authenticity) and carries a CVSS 3.1 score of 5.3 (Medium).

Business impact

Organizations using this plugin to accept PayPal payments for WooCommerce forms face revenue loss from payment bypass fraud. Attackers can fulfill orders without tendering correct payment amounts, directly reducing transaction integrity. The attack requires no user interaction and no authentication, making it accessible to any attacker aware of pending order IDs. Affected sites may experience customer disputes, chargeback claims, and inventory depletion. Sites processing high-transaction-value orders via the plugin face the greatest financial exposure.

Affected systems

The Contact Form 7 – PayPal & Stripe Add-on for WordPress is affected in all versions up to and including 2.4.9. The plugin integrates contact forms with PayPal payment processing, typically in WooCommerce or custom WordPress checkout flows. Any WordPress installation using this plugin to process PayPal transactions is vulnerable if not updated.

Exploitability

Exploitability is high. The attack requires no authentication, no user interaction, and no special access. An attacker needs only the ability to craft an HTTP POST request to the plugin's IPN endpoint and knowledge of (or ability to enumerate) pending order IDs. A minimal real PayPal payment serves as cover to establish IPN credibility. The vulnerability is trivial to exploit with basic scripting; no complex tooling is required. The network attack vector and low complexity make this a practical threat for any site publicly running the vulnerable plugin.

Remediation

Update the Contact Form 7 – PayPal & Stripe Add-on to the latest patched version immediately. Verify the patch version against the official WordPress plugin repository or vendor advisory to confirm the fix includes validation of mc_gross, mc_currency, and receiver_email fields against stored order data. If a patch is not yet available, disable PayPal payment processing in the plugin, suspend order fulfillment via the affected payment method, or temporarily migrate to an alternative payment processor pending a security update.

Patch guidance

Check the official Contact Form 7 – PayPal & Stripe Add-on page in the WordPress plugin directory for available updates. Apply the latest version as soon as it is released. Before deployment, test the patched version in a staging environment to confirm PayPal IPN notifications are still processed correctly and orders are marked complete only when payment details match stored values. Review your site's order logs during the vulnerability window for any suspicious completed orders with mismatched payment amounts.

Detection guidance

Monitor PayPal IPN logs and webhook records for invoice parameters that do not correspond to the order initiated by the contact form or for payments with mc_gross values significantly lower than corresponding order totals. Audit completed orders marked paid during the exposure period; flag any where the PayPal transaction amount does not reconcile with the order subtotal. Implement logging of all IPN validation steps to identify rejected or inconsistent notifications. Check for evidence of multiple IPN submissions for the same order ID or invoice parameter with different amounts. Review web server access logs for repeated POST requests to the IPN handler endpoint from unknown sources.

Why prioritize this

This vulnerability should be prioritized for urgent patching because it directly undermines payment integrity with zero-interaction exploitability. Unlike many medium-severity flaws, CVE-2026-9189 enables direct, undetectable revenue theft for any organization accepting payments through the vulnerable plugin. The attack surface is the public-facing IPN endpoint, and the impact is immediate financial loss. The simplicity of exploitation and absence of indicators that alert users to fraud make this a material risk despite the CVSS 5.3 rating.

Risk score, explained

CVSS 3.1 assigns this vulnerability a score of 5.3 (Medium) based on network attack vector, low complexity, no privilege requirements, and no user interaction, but limited scope and no direct confidentiality impact. However, the integrity impact (I:L) underrepresents the actual business harm: the flaw enables direct financial fraud. Organizations handling high-transaction volumes or high-value orders should treat this as functionally critical, despite the medium CVSS label. The financial and reputational consequences may warrant a higher internal severity classification.

Frequently asked questions