CVE-2026-82844: WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce
The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its notification emails are sent even though no order exists at the payment provider and no payment is recorded.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
WPForms Lite versions before 2.0.2.2 are affected when forms use the PayPal Commerce gateway and are intended to require payment before accepting submissions.
What does an attacker need to exploit this issue?
An attacker only needs network access to the affected form. No authentication, user interaction, or payment completion is required.
What is the practical impact of exploitation?
An unauthenticated visitor can submit a paid form without paying. The form confirmation and notification emails are still sent, while no order exists at the payment provider and no payment is recorded.
How can administrators identify potentially affected submissions?
Review submissions from PayPal Commerce forms for cases where a confirmation and notification emails were generated but there is no corresponding PayPal provider order or recorded payment.
What mitigation is indicated by the available information?
Update WPForms Lite to version 2.0.2.2 or later. If updating is not immediately possible, avoid relying on PayPal Commerce form submissions as proof of payment and verify payment records at the provider before fulfilling requests.