Executive brief
The Contact Form 7 PayPal & Stripe Add-on plugin for WordPress is vulnerable to a flaw that allows attackers to redirect users to malicious websites. By tricking a user into clicking a specially crafted link, an attacker can send them to a fake login page or phishing site immediately after they complete or cancel a legitimate payment process. This can be used to steal credentials or financial information by exploiting the trust the user has in the original website.
Technical details
An open redirect vulnerability exists in the Contact Form 7 – PayPal & Stripe Add-on plugin due to insufficient validation of the 'cf7pp_return' parameter. The plugin uses 'filter_var($url, FILTER_VALIDATE_URL)' which confirms a string is a valid URL but does not verify that the host matches the legitimate site. An unauthenticated attacker can craft a link that populates the Stripe 'success_url' and 'cancel_url' parameters with an arbitrary external domain. When a victim completes or cancels a Stripe checkout session initiated via this link, they are automatically redirected to the attacker-controlled site. This vulnerability is fixed in version 2.5.
Affected products
- Unknown Contact Form 7 – PayPal & Stripe Add-on < 2.5
Timeline
- 2026-07-06: disclosed: Publicly published on WPScan
- 2026-07-27: advisory: CVE published to NVD
- 2026-07-27: patched: Fixed in version 2.5