Quick answers
- Is CVE-2026-4986 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-4986 being exploited in the wild.
- How severe is CVE-2026-4986?
- Informational severity, with a CVSS score of 5.3, published 9 June 2026.
- Which products and versions are affected?
- WPForms Lite < 1.10.0.5.
- Is there a fix for CVE-2026-4986?
- A patch was published on 2026-05-19: Fixed in version 1.10.0.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-4986 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-4986?
- Check whether you run WPForms Lite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The WPForms plugin (specifically the Lite version) fails to perform cryptographic signature verification or origin validation on incoming PayPal webhook notifications. This vulnerability is classified as Missing Authorization (CWE-862). An unauthenticated remote attacker can send specially crafted HTTP POST requests to the webhook listener endpoint, mimicking legitimate PayPal notifications. This allows the attacker to manipulate the payment status of arbitrary transactions within the WordPress database, such as marking an unpaid order as 'Completed'. The issue is resolved in version 1.10.0.5.
Affected products
- WPForms WPForms Lite < 1.10.0.5
Timeline
- 2026-05-19: disclosed: Publicly published by WPScan
- 2026-05-19: patched: Fixed in version 1.10.0.5
- 2026-06-09: advisory: CVE published to NVD dataset