# CVE-2026-7792: WPForms PayPal Commerce webhook data authenticity bypass Source: https://junglewise.ai/threats/cve-2026-7792-wpforms-paypal-commerce-webhook-data-authenticity-bypass Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-06-06. Updated: 2026-06-06 License: CC BY 4.0 with a link back CVE-2026-7792 · Severity: medium · CVSS 5.3 · Published 2026-06-06 WPForms is a popular WordPress plugin used to create contact and payment forms. A security flaw in its PayPal integration allows unauthorized individuals to forge payment notifications. This could allow an attacker to reactivate cancelled or suspended subscriptions without actually paying, potentially leading to loss of revenue and unauthorized access to premium services. Technologies: [WPForms](https://junglewise.ai/threats/technologies/wpforms). Vendors: [WPForms](https://junglewise.ai/threats/vendors/wpforms). ## Quick answers **Is CVE-2026-7792 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7792 being exploited in the wild. **How severe is CVE-2026-7792?** Medium severity, with a CVSS score of 5.3, published 6 June 2026. **Which products and versions are affected?** WPForms up to and including 1.10.0.1. **Is there a fix for CVE-2026-7792?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it. **How is CVE-2026-7792 attacked?** It is attacked over the network, in a software library. **Am I affected by CVE-2026-7792?** Check whether you run WPForms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## Technical details The WPForms plugin fails to verify the HMAC-SHA256 signature of incoming JSON payloads at the PayPal Commerce webhook endpoint. The vulnerable component only checks if the 'event_type' is whitelisted before processing the data. An unauthenticated remote attacker who knows a valid PayPal subscription_id can send forged webhook events to the endpoint. This allows the attacker to manipulate subscription records, such as changing a 'cancelled' or 'suspended' status to 'active' by providing malicious resource data. The issue is present in versions up to and including 1.10.0.1. ## Affected products - WPForms WPForms up to and including 1.10.0.1 ## Timeline - 2026-06-06: disclosed: CVE published to NVD ## References - [https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.1/src/Integrations/PayPalCommerce/Api/WebhookRoute.php](https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.1/src/Integrations/PayPalCommerce/Api/WebhookRoute.php) - [https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.1/src/Integrations/PayPalCommerce/Api/WebhookRoute.php](https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.1/src/Integrations/PayPalCommerce/Api/WebhookRoute.php) - [https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.1/src/Integrations/PayPalCommerce/Api/Webhooks/BillingSubscriptionActivated.php](https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.1/src/Integrations/PayPalCommerce/Api/Webhooks/BillingSubscriptionActivated.php) - [https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.1/src/Integrations/PayPalCommerce/Api/Webhooks/BillingSubscriptionCancelled.php](https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.1/src/Integrations/PayPalCommerce/Api/Webhooks/BillingSubscriptionCancelled.php) - [https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.4/src/Integrations/PayPalCommerce/Api/WebhookRoute.php](https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.4/src/Integrations/PayPalCommerce/Api/WebhookRoute.php) - [https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.4/src/Integrations/PayPalCommerce/Api/WebhookRoute.php](https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.4/src/Integrations/PayPalCommerce/Api/WebhookRoute.php) - [https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.4/src/Integrations/PayPalCommerce/Api/Webhooks/BillingSubscriptionActivated.php](https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.4/src/Integrations/PayPalCommerce/Api/Webhooks/BillingSubscriptionActivated.php) ## Related threats - [WPForms plugin reflected cross-site scripting in smart tags](https://junglewise.ai/threats/cve-2026-101921-the-wpforms-ai-form-builder-for-wordpress-contact-forms-payment) - [WPForms access control bypass in Stripe payment handling](https://junglewise.ai/threats/cve-2026-74991-the-wpforms-wordpress-plugin-before-2-0-2-does-not-verify-that-a) - [WPForms Stored XSS in OptinMonster Integration](https://junglewise.ai/threats/cve-2026-15782-wpforms-stored-xss-in-optinmonster-integration) - [WPForms CRLF injection in email notifications](https://junglewise.ai/threats/cve-2026-12127-wpforms-crlf-injection-in-email-notifications)