What the vulnerability does
01Description
The CP Contact Form with PayPal plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.56. This is due to the plugin exposing an unauthenticated IPN-like endpoint (via the 'cp_contactformpp_ipncheck' query parameter) that processes payment confirmations without any authentication, nonce verification, or PayPal IPN signature validation. This makes it possible for unauthenticated attackers to mark form submissions as paid without making actual payments by sending forged payment notification requests with arbitrary POST data (payment_status, txn_id, payer_email).
Explanation of Vulnerability in Simple Terms
02Summary
CP Contact Form with PayPal versions 1.3.56 and earlier lack proper authorization checks, allowing unauthenticated attackers to modify form data or settings over the network. The vulnerability does not expose sensitive information or disrupt availability, but attackers can alter form content, submissions, or configuration without needing to log in or interact with a user.
What an attacker can do
03Attacker Capabilities
Modify contact form data, settings, or submissions without authentication.
Potential impact on your site
04Site Impact
Attackers can alter your contact forms, change submission handling, or corrupt form data without your knowledge or permission.
Conditions required to exploit
05Prerequisites
Network access to the site; no login or user interaction required.
Key dates
06Disclosure timeline
November 22, 2025
CVE published
April 8, 2026
Record updated
