The WPForms plugin for WordPress lacks required HMAC-SHA256 verification on its PayPal Commerce webhook endpoint, allowing any unauthenticated actor who knows a subscription_id to forge webhook messages. The plugin processes the JSON payload, checks only a whitelisted event_type, and then calls handlers that update subscription payment records. This flaw is a classic data authenticity problem (CWE‑345) and could lead to unauthorized reactivation of cancelled or suspended subscriptions, potentially enabling fraudulent charges or service misuse. The impact is confined to modification of subscription status and administrative data, not arbitrary code execution but still significant for business revenue integrity.

WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin, any installed version up to and including 1.10.0.1. The impact on later versions is unknown and should be verified.

With a CVSS score of 5.3, the vulnerability presents moderate severity. EPSS is not reported, and it is not listed in the CISA KEV catalog. The attack vector is an unauthenticated network request; an attacker can send a crafted webhook to the exposed endpoint, bypassing the lack of signature validation. No additional system compromise is required, making the exploitation straightforward for a threat actor who can identify a subscription_id. The vulnerability exploits a lack of trusted data verification, enabling manipulation of subscription payment data.