The WPForms Lite WordPress plugin prior to version 2.0.2.2 does not perform server‑side verification that a PayPal Commerce transaction has completed before accepting a form submission. As a result, any visitor can submit a payment‑required form, trigger the confirmation page, and cause notification emails to be sent, even though no order exists in PayPal and no payment is recorded. The consequence is loss of expected revenue and the introduction of unverified data into the site’s backend.

WordPress sites running WPForms Lite plugin versions 1.10.0.1 through 2.0.2.1 and configured to use the PayPal Commerce gateway are susceptible. Any site administrator that has installed one of these vulnerable plugin versions and has payment‑enabled forms exposed to the public is impacted.

With a CVSS score of 5.3 the vulnerability is moderate in severity and there is no known exploitation activity listed in CISA’s KEV catalog. The attack vector requires an attacker only to submit a payment‑enabled form on a vulnerable site; no authentication or code execution is required, which makes the logical flaw relatively easy to exploit if the plugin remains unpatched.