CVE-2026-105990: Accept PayPal Payments Plugin Data Leak

CVE-2026-105990 Overview

CVE-2026-105990 affects the Accept PayPal Payments using Contact Form 7 WordPress plugin in versions prior to 4.0.7. The plugin exposes stored form submissions through an export endpoint that lacks authorization checks. Unauthenticated remote attackers can download personal data and payment metadata for every user who submitted a payment form. Exposed fields include name, email, telephone, postal address, message content, and PayPal payment metadata. The flaw is categorized under [CWE-200] Information Exposure.

Critical Impact
Any unauthenticated attacker with network access to the WordPress site can exfiltrate stored customer personal data and payment metadata without authentication or user interaction.

Affected Products

Accept PayPal Payments using Contact Form 7 WordPress plugin, all versions prior to 4.0.7
WordPress sites processing payments through the vulnerable plugin
Any site storing form submissions handled by the plugin

Discovery Timeline

2026-10-10 - CVE-2026-105990 published to the National Vulnerability Database
2026-10-13 - Record last modified in NVD

Technical Details for CVE-2026-105990

Vulnerability Analysis

The plugin provides an export function that returns stored form submissions collected by Contact Form 7 payment forms. The export handler does not validate the requester's identity or capability before returning data. An attacker reaches the endpoint directly over HTTP and receives the full dataset. The attack requires no credentials, no user interaction, and only network reachability to the target site.

The exposed records include personally identifiable information (PII) such as full name, email address, telephone number, postal address, and free-text message content. Payment metadata associated with PayPal transactions is also returned. For sites that process customer orders through the plugin, each successful request can disclose the full submission history.

Root Cause

The vulnerability stems from a missing authorization check on the submission export routine. The plugin registers an export action but omits a current_user_can() capability check and does not verify a nonce. The handler proceeds to read stored submissions from the database and stream them to the caller regardless of session state.

Attack Vector

Exploitation is performed by issuing an HTTP request to the export endpoint exposed by the plugin on a vulnerable WordPress installation. Because the handler accepts unauthenticated requests, an attacker can script bulk collection across many sites that run the plugin. Full technical details are published in the WPScan Vulnerability Report.

No verified public proof-of-concept code is available in the enriched data. The vulnerability mechanism is a missing access control decision on a data-export handler, not a memory safety or injection flaw.

Detection Methods for CVE-2026-105990

Indicators of Compromise

Unauthenticated HTTP requests to plugin admin-ajax or admin-post actions associated with submission export
Large outbound HTTP response bodies from WordPress endpoints containing CSV or JSON submission data
Requests to plugin export URLs from IP addresses that have never authenticated to /wp-login.php
Spikes in requests to plugin paths under /wp-content/plugins/ referencing the Accept PayPal Payments module

Detection Strategies

Review WordPress access logs for repeated anonymous requests to plugin export endpoints and correlate with unusual response sizes
Alert on HTTP 200 responses to export actions where the request lacks a valid session cookie or _wpnonce parameter
Deploy a web application firewall rule that requires authentication for any request targeting the plugin's export handler

Monitoring Recommendations

Centralize WordPress and reverse-proxy logs and search for the plugin slug across request URIs
Monitor outbound data volumes from the web tier and flag single responses that exceed historical baselines for the plugin path
Track plugin inventory and version data across all WordPress sites to identify installations below version 4.0.7

How to Mitigate CVE-2026-105990

Immediate Actions Required

Upgrade the Accept PayPal Payments using Contact Form 7 plugin to version 4.0.7 or later on every affected site
Audit stored submissions and assume disclosure if logs show anonymous requests to export endpoints before patching
Notify affected data subjects where disclosure is confirmed, in accordance with applicable privacy regulations

Patch Information

The vendor released version 4.0.7, which adds authorization checks on the submission export handler. Site operators should update through the WordPress plugin manager or by replacing the plugin directory with the fixed release. Refer to the WPScan Vulnerability Report for the fixed version reference.

Workarounds

Deactivate the plugin until the update to 4.0.7 can be applied
Block external access to the plugin's export action at the web application firewall or reverse proxy
Restrict /wp-admin/admin-ajax.php and /wp-admin/admin-post.php requests referencing the plugin to authenticated administrator sessions

bash

# Example nginx rule to block unauthenticated access to the plugin export action
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "cf7pp_export") {
        return 403;
    }
}