The CP Contact Form with PayPal plugin contains a missing authorization flaw that allows an unauthenticated attacker to trigger payment confirmation logic without providing valid PayPal IPN credentials. By sending a forged request containing arbitrary POST data (payment_status, txn_id, payer_email) to the unprotected cp_contactformpp_ipncheck endpoint, an attacker can mark any form submission as paid even though no actual transaction has taken place. This could enable financial fraud, inflate metrics, or trigger downstream processes that rely on confirmed payments.

WordPress sites running CP Contact Form with PayPal through version 1.3.56 or earlier are impacted. The vulnerability is present in all releases of the plugin with a public endpoint that accepts unauthenticated POST data and does not verify a PayPal signature or nonce.

The CVSS score of 7.5 indicates a high severity. The EPSS score is below 1%, suggesting a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need only network access to the site and the ability to send HTTP POST requests to the cp_contactformpp_ipncheck query string. No authentication or special test prerequisites are required, making the vulnerability readily exploitable by automated scripts.