The vulnerability in the Contact Form 7 plugin arises from insufficient validation in the function that can skip spam checks during Stripe payments. This grants unauthenticated users the ability to repeat the same Stripe PaymentIntent across multiple form submissions. While only the first submission triggers a real charge, the plugin falsely reports success for every replayed request, potentially fooling site administrators into preparing and shipping products that were never legitimately paid for. The weakness is classified under CWE-354. The impact is mainly reputational and operational, exposing the site to unnecessary inventory depletion and mistaken fulfillment requests.

WordPress sites running Contact Form 7 version 6.0.5 or earlier are affected. The issue originates from the Stripe integration within the plugin; only the mentioned versions contain the flawed logic.

The CVSS score of 5.3 indicates moderate severity, reflecting the risk of accidental or malicious order replay. The EPSS score is less than 1 %, suggesting that current exploit activity is very low, but the vulnerability is publicly documented, and an attacker could craft HTTP requests to trigger the replay without authentication. The vulnerability is not listed in the CISA KEV catalog, so there are no known active exploits, yet the simplicity of the trigger means it can be exploited quickly once the attacker obtains a Stripe PaymentIntent ID. The likely attack vector is remote, via crafted form submissions to the web server hosting the plugin.