The Accept PayPal Payments using Contact Form 7 WordPress plugin prior to 4.0.7 fails to enforce authentication or validate requests on a specific AJAX endpoint, enabling hostile actors to impersonate a user and alter stored transaction status values. This can cause false revenue records, obscure actual transaction outcomes, and allow attackers to inject status metadata into arbitrary posts. The flaw constitutes an improper access control vulnerability that permits unauthenticated modification of application data.

The issue affects installations of the Accept PayPal Payments using Contact Form 7 WordPress plugin whose version is older than 4.0.7. Users running any WordPress site that includes this plugin prior to that release are vulnerable. No additional product or version details are disclosed beyond the plugin name and the < 4.0.7 threshold.

The vulnerability can be exercised by sending a crafted HTTP request to the vulnerable AJAX URL, which an unauthenticated attacker can perform from any origin, thus exposing any user or site to data tampering. No exploit code is linked, but the flaw is straightforward to reproduce. The EPSS score is < 1%, indicating a very low but nonzero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, implying no known large‑scale exploit. The CVSS score of 5.3 indicates moderate severity.