Description

Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T14:17:09.730Z",
  "pubdate": "2026-08-13T14:17:09.730Z",
  "executiveSummary": "An unauthenticated broken access control vulnerability exists in the Contact Form 7 – PayPal & Stripe Add-on plugin for WordPress, specifically affecting versions 2.5.1 and below. This security flaw allows unauthenticated remote attackers to interact with vulnerable plugin functionality without proper authorization checks.\nThe vulnerability exposes sensitive operations or data handling tied to the payment processing features of the add-on. Successful exploitation can lead to unauthorized state changes, data exposure, or manipulation of transactional logic depending on the exposed endpoints. Because the flaw does not require authentication, any remote attacker can interact directly with the vulnerable handlers over the network.\nThe risk implication is significant as it compromises the integrity and confidentiality of the affected form submission and payment processing pipeline. Exploitation requirements are minimal, as the attacker only needs network access to the target WordPress installation and the ability to trigger the unauthenticated endpoints associated with the Contact Form 7 – PayPal & Stripe Add-on.\nOrganizations utilizing the affected software are at risk of unauthorized interactions and potential data leakage. Immediate remediation requires applying official security updates provided by the vendor, restricting direct access to vulnerable plugin endpoints, and monitoring access logs for anomalous requests targeting the add-on's request handlers.",
  "technicalDetails": "The root cause of this vulnerability stems from the absence of proper authorization checks and capability validations within request handlers exposed by the Contact Form 7 – PayPal & Stripe Add-on plugin for versions 2.5.1 and below. The application fails to verify whether an incoming HTTP request originates from an authenticated user with sufficient privileges before executing sensitive backend logic.\nThe vulnerable components are the server-side action handlers and AJAX/REST endpoints registered by the plugin to process payment integrations and form submissions. These endpoints lack robust session validation and nonce verification, allowing external actors to invoke procedural logic directly.\nNetwork exposure is fully public, as these handlers are typically exposed via WordPress standard AJAX or REST API routing, making them accessible to any remote user over HTTP and HTTPS protocols. Authentication requirements are entirely absent, and zero privileges are required to interact with the vulnerable endpoints.\nThe attack flow proceeds as follows: First, an unauthenticated attacker identifies the presence of the Contact Form 7 – PayPal & Stripe Add-on on a target WordPress site. Second, the attacker crafts a malicious HTTP request targeting the specific unprotected endpoint exposed by the plugin. Third, because the underlying code does not validate user sessions, roles, or capabilities, the application processes the request as if it were legitimate.\nPost-exploitation impact varies based on the specific functions exposed by the vulnerable endpoints but generally includes unauthorized execution of plugin routines, potential manipulation of form transaction states, or unauthorized retrieval of sensitive data handled by the payment add-on. The payload behavior relies on exploiting the missing access controls to trigger backend logic outside of the intended application workflow."
}