The WPForms WordPress plugin before 1

WPForms' PayPal Standard/Commerce integration exposes a webhook endpoint that accepts incoming payment event notifications (e.g., PAYMENT.SALE.COMPLETED) but never validates the PayPal-Transmission-Sig header, PAYPAL-CERT-URL, or webhook ID against PayPal's verification API. Any unauthenticated actor who knows or guesses the site's webhook URL can POST a forged JSON body and mark an arbitrary form submission / order as paid, fulfilled, refunded, or cancelled. Affected: WPForms 1.10.0.1 through 1.10.0.4 (Lite and Pro paths that ship the PayPal addon). Fixed in 1.10.0.5.

Vendor rating of 5.3 MEDIUM / Integrity:Low is defensible on the raw CIA math — no confidentiality loss, no availability impact, integrity limited to payment-state records. But the *business* impact (fraudulent order fulfillment, refund abuse, subscription state flips) is worse than the CVSS suggests for the subset of sites using WPForms as a checkout. For the vast majority of WPForms installs (contact forms, lead capture, no payment addon enabled), the endpoint isn't reachable in a meaningful way and the CVE is inert. Net: MEDIUM is fair as a fleet-wide rating; sites actually taking money via WPForms+PayPal should treat this as HIGH for themselves.

Why this verdict

• Unauthenticated + network reachable keeps this from being LOW — anyone on the Internet can hit the endpoint, no phishing or foothold required.
• Integrity-only, single-tenant blast radius caps it at MEDIUM — attacker can flip payment state on the target site but cannot read data, escalate on the host, or pivot to other WordPress sites.
• Role multiplier: WPForms is *not* in the high-value-role catalog. Even on an e-commerce site, the affected surface is one plugin's payment reconciliation table, not the identity, hypervisor, or CI plane. No fleet-scale outcome is plausible.
• Friction: PayPal addon required. The base WPForms plugin doesn't expose the vulnerable listener — the paid PayPal addon must be installed and activated. Most WPForms sites use it purely for contact/lead forms and are unaffected.
• Friction: business logic often catches it. Sites doing manual fulfillment, accounting reconciliation, or PayPal-dashboard cross-checks detect forged 'paid' states within days. Fully-automated dropship or digital-goods sites are the real victims.
• EPSS 0.2% and no KEV listing — no exploitation pressure driving an upgrade.

Why not higher?

HIGH would require either fleet-scale blast radius (this is per-site, integrity-only) or credible active exploitation (none reported, EPSS <1%). The bug can't be chained into RCE, credential theft, or lateral movement on the WordPress host — it terminates at a database field flip.

Why not lower?

LOW would ignore that the attack is unauthenticated, remotely reachable, trivial to weaponize from PayPal's public webhook schema, and directly monetizable on affected e-commerce sites. A site owner facing free-goods fraud does not experience this as LOW.

1. Update WPForms to 1.10.0.5 or later — The definitive fix. Push through your WordPress patch pipeline within the noisgate MEDIUM 365-day window, but if you run WPForms + PayPal for real revenue, treat as HIGH for your own environment and deploy inside 30 days.
2. WAF-block the webhook endpoint to PayPal IP ranges only — Add a Cloudflare / Wordfence / ModSecurity rule allowing POSTs to /?wpforms-listener=paypal and the plugin's REST route ONLY from PayPal's published IPN/webhook egress ranges. Deploy same-day on money-taking sites as an interim gate.
3. Enable PayPal-side reconciliation job — Nightly cron: pull PayPal transaction ledger via API, diff against WPForms entries flagged payment_status=completed, alert on any WPForms 'paid' entry with no matching PayPal transaction. Catches forgeries within 24h even on unpatched sites.
4. Disable auto-fulfillment on WPForms payment triggers — For high-risk workflows (digital downloads, license keys, shipping label generation), require manual approval or a second signal (e.g., Stripe order, PayPal API pull) before fulfillment until patched.

Run this on the WordPress host (or via SSH to it) as any user with read access to wp-content/plugins/. Invoke as ./check-wpforms.sh /var/www/html where the argument is the WordPress docroot. No root required.

#!/usr/bin/env bash
# noisgate verifier for CVE-2026-4986 (WPForms PayPal webhook forgery)
# Usage: ./check-wpforms.sh <wordpress-docroot>
set -u
DOCROOT="${1:-/var/www/html}"
FIXED="1.10.0.5"

if [ ! -d "$DOCROOT" ]; then
  echo "UNKNOWN: docroot $DOCROOT not found"
  exit 2
fi

PLUGIN_FILE=$(find "$DOCROOT/wp-content/plugins" -maxdepth 3 -type f -name 'wpforms.php' 2>/dev/null | head -n1)
if [ -z "$PLUGIN_FILE" ]; then
  # Lite variant
  PLUGIN_FILE=$(find "$DOCROOT/wp-content/plugins" -maxdepth 3 -type f -name 'wpforms-lite.php' 2>/dev/null | head -n1)
fi

if [ -z "$PLUGIN_FILE" ]; then
  echo "PATCHED: WPForms plugin not installed on this host"
  exit 0
fi

VERSION=$(grep -iE '^\s*\*?\s*Version:' "$PLUGIN_FILE" | head -n1 | sed -E 's/.*Version:\s*([0-9.]+).*/\1/')
if [ -z "$VERSION" ]; then
  echo "UNKNOWN: could not parse version from $PLUGIN_FILE"
  exit 2
fi

# Check whether PayPal addon is active (increases real risk)
PAYPAL_ADDON=$(find "$DOCROOT/wp-content/plugins" -maxdepth 4 -type d -iname 'wpforms-paypal*' 2>/dev/null | head -n1)

# semver compare: vulnerable if 1.10.0.1 <= v < 1.10.0.5
awk_cmp() { awk -v v="$1" -v f="$2" 'BEGIN{split(v,a,"."); split(f,b,"."); for(i=1;i<=4;i++){x=a[i]+0;y=b[i]+0; if(x<y){print "lt";exit} else if(x>y){print "gt";exit}} print "eq"}'; }
LOWER=$(awk_cmp "$VERSION" "1.10.0.1")
UPPER=$(awk_cmp "$VERSION" "$FIXED")

if { [ "$LOWER" = "gt" ] || [ "$LOWER" = "eq" ]; } && [ "$UPPER" = "lt" ]; then
  if [ -n "$PAYPAL_ADDON" ]; then
    echo "VULNERABLE: WPForms $VERSION with PayPal addon active — CVE-2026-4986 exploitable"
    exit 1
  else
    echo "VULNERABLE: WPForms $VERSION installed (PayPal addon not detected — bug present but not reachable). Patch anyway."
    exit 1
  fi
fi

echo "PATCHED: WPForms $VERSION (>= $FIXED or outside affected range)"
exit 0

Sources

1. WPScan advisory
2. NVD — CVE-2026-4986
3. Vulnerability-Lookup CIRCL
4. PayPal — Verify a Webhook Signature
5. CWE-862 Missing Authorization
6. WPForms Changelog
7. CISA KEV Catalog