A missing authorization flaw in the ZealousWeb "Accept PayPal Payments using Contact Form 7" extension lets a user bypass intended access controls to trigger payment processing actions. The weakness, identified as CWE-862, could enable an attacker to execute payments or modify payment settings without proper privileges, compromising the integrity and confidentiality of financial transactions.

All installations of the ZealousWeb Accept PayPal Payments using Contact Form 7 WordPress plugin up to and including version 4.0.4 are vulnerable. The vulnerability targets the plugin’s configuration and payment execution paths within the WordPress environment.

No EPSS score is available and the issue is not listed in CISA’s KEV catalog, indicating limited publicly known exploitation data. Based on the description, it is inferred that the likely attack vector is through the WordPress web interface, exploiting incorrectly configured role or capability checks; only users who can access the plugin settings could leverage the flaw. The CVSS severity is not provided, but the potential to disrupt or fabricate payments represents a high-severity risk for sites relying on this extension.