CVE-2026-7792: WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint
The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to and including 1.10.0.1. This is due to the PayPal Commerce webhook endpoint processing unauthenticated JSON webhook payloads without verifying that the request originated from PayPal using the required HMAC-SHA256 webhook signature, and only checking whether the supplied eventtype is whitelisted before dispatching the attacker-controlled resource data to handlers that update payment records. This makes it possible for unauthenticated attackers who know a valid PayPal subscriptionid to forge PayPal webhook events and modify subscription payment records, such as reactivating a cancelled or suspended subscription by setting its subscriptionstatus to active.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
WPForms – Easy Form Builder for WordPress (PayPal Commerce webhook integration)from your environment.Uninstall or deactivate the WPForms PayPal Commerce webhook integration or the WPForms plugin if it is not required until an official vendor patch is available and applied.
- Configuration
Verify that incoming PayPal webhook requests include the HMAC-SHA256 webhook signature and validate the signature before processing the JSON payload. Reject and do not process webhook events that lack a valid signature.
WPForms PayPal Commerce webhook endpoint webhook_signature_verification = HMAC-SHA256 - Configuration
Do not dispatch attacker-controllable resource data to payment/subscription handlers based solely on a whitelisted event_type. Validate and sanitize the resource data and confirm the authenticity of the event (e.g., via verified signature) before updating payment or subscription records.
WPForms PayPal Commerce webhook handler event/resource validation before dispatch = validate_and_sanitize - Compensating control
Restrict access to the PayPal webhook endpoint via firewall, WAF, or network ACLs to only trusted PayPal IP ranges or otherwise limit exposure until signature verification or a vendor patch is implemented.
- Operational
Audit subscription and payment records for unauthorized modifications (for example, reactivated or modified subscriptions) and revert or remediate any unauthorized changes. Notify affected customers and follow incident response procedures if fraudulent changes are found.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7792?
CVE-2026-7792 has a medium severity level of 5.3.
What is CVE-2026-7792 about?
CVE-2026-7792 relates to insufficient verification of data authenticity in the PayPal Commerce webhook endpoint of WPForms versions up to 1.10.0.1.
How do I fix CVE-2026-7792?
To remediate CVE-2026-7792, update your WPForms plugin to version 1.10.0.5 or later.
What impact does CVE-2026-7792 have on my website?
CVE-2026-7792 can potentially allow unauthenticated users to manipulate payment data processed by the WPForms plugin.
Which versions of WPForms are affected by CVE-2026-7792?
CVE-2026-7792 affects all versions of WPForms up to and including 1.10.0.1.