Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-105990: Accept PayPal Payments plugin lets anyone export payer data
CVE-2026-105990 · published 25 days ago
Summary
The Accept PayPal Payments for Contact Form 7 WordPress plugin (versions before 4.0.7) allows anyone on the internet to download the personal information and payment details that users entered in the form. This can expose names, emails, phone numbers, addresses and payment metadata. Upgrade the plugin to version 4.0.7 or later, or disable the export feature, to protect that data.
What to do
- Update unknown accept paypal payments using contact form 7 to version 4.0.7 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | accept paypal payments using contact form 7 | < 4.0.7 |
Original advisory text
Accept PayPal Payments Using Contact Form 7 < 4.0.7 - Unauthenticated PII Disclosure via CSV Export
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data (name, email, telephone, postal address, message) and payment metadata of everyone who submitted a payment form.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
5.3
Medium
Type
CWE-200Information Exposure
Timeline
Published10 Oct 2026
Updated4 Nov 2026
First seen10 Oct 2026
Track software like this
Free during beta