The PayPal Forms WordPress plugin allows unauthenticated attackers to construct new PayPal payment forms and modify existing payment settings because the plugin fails to validate nonces on form creation and management operations. This flaw enables an attacker to alter how payments are processed on a site, potentially redirecting funds, collecting sensitive information, or disabling legitimate transaction flows. The core weakness is a missing CSRF nonce, which is a documented cross‑site request forgery vulnerability (CWE‑352).

Platform: WordPress plugin named PayPal Forms from vendor bsmye. All releases up to and including version 1.0.3 are affected. The vulnerability is present in the form creation and management features accessed by site administrators.

The overall CVSS score is 4.3, indicating a moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation at this time, and the flaw is not listed in the CISA KEV catalog. The attack requires the attacker to lure an administrator into submitting a crafted request, for example by clicking a malicious link. Once the request is processed, the attacker can create or alter PayPal payment forms without authentication. The expected impact is limited to compromised transaction configuration rather than full system compromise, but it can lead to financial loss or exposure of payment data if configuration changes allow illicit funds to be routed elsewhere. The risk is moderate, with exploitation likely constrained to environments where administrators do not exercise stringent click‑through vetting and where the plugin is installed in its vulnerable state.