WordPress WPForms Lite plugin 1.10.0.1-2.0.2.1 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Abdulrhman Mari d7mr4ny in WordPress Plugin Contact Form by WPForms versions 1.10.0.1-2.0.2.1...

CVE-2026-82844

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its...

CVE-2026-82844 WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its...

CVE-2026-82844 WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its...

CVE-2026-82844

The WPForms Lite WordPress plugin (versions 1.10.0.1 - 2.0.2.1 ) contains a vulnerability where it fails to perform server-side verification of completed payments when using the PayPal Commerce gateway . This allows unauthenticated visitors to submit paid forms without making an actual payment. C...

EUVD-2026-100976

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its...

CVE-2026-82844: Insufficient Verification of Data Authenticity

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its...

CVE-2026-84744

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments...

CVE-2026-84744 WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments...

CVE-2026-84744

The WPForms Lite WordPress plugin (versions 1.5.0.1 to 2.0.2 ) is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is the failure to remove shortcode delimiters from submitted field values before repopulating them into the rendered form. This flaw allows an unauthentic...

CVE-2026-84744 WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments...

EUVD-2026-88098

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments...

CVE-2026-84744: Improper Control of Generation of Code

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments...

PT-2026-99773

Name of the Vulnerable Software and Affected Versions WPForms Lite versions 1.5.0.1 through 2.0.2 Description The plugin fails to remove shortcode delimiters from submitted field values before they are written back into the rendered form. This allows unauthenticated users to execute arbitrary...

CVE-2026-74991 WPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntent

The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing unauthenticated users to trigger a full refund and an immediate subscription cancellation against payments created by other...

CVE-2026-74991

The WPForms WordPress plugin, in versions before 2.0.2 , contains a vulnerability where it fails to verify that a Stripe payment object provided during a public form submission belongs to the plugin. This lack of validation allows unauthenticated users to trigger a full refund and an immediate su...

CVE-2026-74991 WPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntent

The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing unauthenticated users to trigger a full refund and an immediate subscription cancellation against payments created by other...

WordPress WPForms Lite plugin < 1.10.0.5 - Unauthenticated PayPal Webhook Forgery vulnerability

Unauthenticated PayPal Webhook Forgery vulnerability discovered by Sudhanshu Chauhan RedHunt Labs in WordPress Plugin Contact Form by WPForms versions 1.10.0.5...

CVE-2026-4986 WPForms Lite < 1.10.0.5 – Unauthenticated PayPal Webhook Forgery

The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before processing them, allowing unauthenticated attackers to forge webhook payloads and manipulate the payment state of arbitrary transactions...

CVE-2026-4986

The WPForms WordPress plugin (including WPForms Lite ) versions prior to 1.10.0.5 are vulnerable to an unauthenticated PayPal webhook forgery . The root cause is a failure to verify the authenticity of incoming PayPal webhook events before processing them. This allows unauthenticated attackers to...