Junglewise Threat Intelligence

CVE-2026-7792: WPForms PayPal Commerce webhook data authenticity bypass

CVE-2026-7792 · Severity: medium · CVSS 5.3 · Published 2026-06-06

Technologies: WPForms. Vendors: WPForms.

Executive brief

WPForms is a popular WordPress plugin used to create contact and payment forms. A security flaw in its PayPal integration allows unauthorized individuals to forge payment notifications. This could allow an attacker to reactivate cancelled or suspended subscriptions without actually paying, potentially leading to loss of revenue and unauthorized access to premium services.

Technical details

The WPForms plugin fails to verify the HMAC-SHA256 signature of incoming JSON payloads at the PayPal Commerce webhook endpoint. The vulnerable component only checks if the 'event_type' is whitelisted before processing the data. An unauthenticated remote attacker who knows a valid PayPal subscription_id can send forged webhook events to the endpoint. This allows the attacker to manipulate subscription records, such as changing a 'cancelled' or 'suspended' status to 'active' by providing malicious resource data. The issue is present in versions up to and including 1.10.0.1.

Affected products

  • WPForms WPForms up to and including 1.10.0.1

Timeline

  • 2026-06-06: disclosed: CVE published to NVD

References

Related threats