CVE-2026-4986 — WPForms Lite < 1.10.0.5 – Unauthenticated PayPal Webhook Forgery
The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before processing them, allowing unauthenticated attackers to fo…
Published: 2026-06-09 · CVSS: 5.3 · CVSS 3.1
The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before processing them, allowing unauthenticated attackers to forge webhook payloads and manipulate the payment state of arbitrary transactions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7