CVE-2026-66660 MEDIUM

CVE-2026-66660: WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability

Vendor Scott Paterson

Product Contact Form 7 – PayPal & Stripe Add-on

Weakness CWE-862 · Missing authorization

Published August 13, 2026

Last update August 13, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Contact Form 7 – PayPal & Stripe Add-on versions up to 2.5.1 lack proper authorization checks on certain operations. An unauthenticated attacker can modify data or disrupt service availability without needing to log in or interact with a user. Update to a version newer than 2.5.1 to resolve this issue.

What an attacker can do

03Attacker Capabilities

Modify form data or disrupt service without authentication.

Potential impact on your site

04Site Impact

Attackers can alter payment form submissions or cause downtime without a valid account.

Conditions required to exploit

05Prerequisites

Network access only; no login or user interaction required.

Key dates

06Disclosure timeline

August 13, 2026 CVE published

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-66660 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html AskarLabs — CWE-862 write-up Missing Authorization

Related vulnerabilities

Identifiers

CVE CVE-2026-66660

CWE CWE-862

CVSS 6.5 / MEDIUM

Affected versions