CVE-2026-105990 — Accept PayPal Payments Using Contact Form 7 < 4.0.7 - Unauthenticated PII Disclosure via CSV Export

CVE-2026-105990

Accept PayPal Payments Using Contact Form 7 < 4.0.7 - Unauthenticated PII Disclosure via CSV Export PUBLISHED

Description (CNA)

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data (name, email, telephone, postal address, message) and payment metadata of everyone who submitted a payment form.

Affected (CNA)

Vendor / product	Versions
Unknown / Accept PayPal Payments using Contact Form 7	affected 0 before 4.0.7

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/211d7613-a7e0-45f9-b262-66651aa4f535/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.