CVE-2026-9189 Business logic in Contact Form 7 – PayPal & Stripe Add-on
Unauthenticated attackers can bypass payment verification to mark high-value orders as paid, resulting in unauthorized purchases.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-9189?
CVE-2026-9189 is a medium-severity vulnerability in scottpaterson Contact Form 7 – PayPal & Stripe Add-on, published on 29 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Contact Form 7 – PayPal & Stripe Add-on plugin for WordPress is vulnerable to Payment Bypass via Insufficient Verification of Data Authenticity in all versions up to, and including, 2.4.9. Although `cf7pp_paypal_ipn_handler()` correctly validates IPN authenticity by posting back to PayPal with `cmd=_notify-validate`, it fails to compare the IPN payload's `mc_gross` (payment amount), `mc_currency`, or `receiver_email` fields against the corresponding stored order values before passing the attacker-controlled `invoice` field directly to `cf7pp_complete_payment()`, which marks the order completed after only an integer cast with no amount verification. This makes it possible for unauthenticated attackers to mark arbitrary high-value pending orders as fully paid by making a minimal real PayPal payment and crafting an IPN whose `invoice` parameter references the targeted order, effectively completing purchases without tendering the required payment amount.
Weakness: CWE-345
Which versions are affected by CVE-2026-9189?
How do I fix CVE-2026-9189?
No fix has been published for CVE-2026-9189 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-9189 being exploited?
There is no known exploitation of CVE-2026-9189 in the wild and no public exploit code.
Sources
Also known as GHSA-vr4h-g9wj-2p4g.