Junglewise Threat Intelligence

CVE-2026-9189: Contact Form 7 , PayPal & Stripe Add-on payment bypass in IPN handler

CVE-2026-9189 · Severity: medium · CVSS 5.3 · Published 2026-05-29

Executive brief

A WordPress plugin used to process payments through Contact Form 7 is vulnerable to a payment bypass. An attacker can trick the system into marking expensive orders as fully paid by making a minimal payment (e.g., $0.01) and manipulating the transaction data. This could result in financial loss for businesses as orders are fulfilled without receiving the correct payment amount.

Technical details

The vulnerability exists in the `cf7pp_paypal_ipn_handler()` function, which fails to validate critical fields in the PayPal Instant Payment Notification (IPN) payload. While the plugin verifies the authenticity of the IPN message with PayPal, it does not compare the `mc_gross` (amount), `mc_currency`, or `receiver_email` against the original order details stored in the database. An attacker can provide a valid IPN from a minimal payment and modify the `invoice` parameter to match a different, high-value pending order. The `cf7pp_complete_payment()` function then marks the targeted order as complete based solely on the attacker-controlled invoice ID without verifying if the paid amount matches the expected total.

Affected products

  • Contact Form 7 – PayPal & Stripe Add-on Team Contact Form 7 – PayPal & Stripe Add-on Up to, and including, 2.4.9

Timeline

  • 2026-05-29: disclosed: CVE published by Wordfence/NVD

References