The WPForms Lite WordPress plugin, in versions before 2.0.2.2, fails to perform server-side verification that a PayPal Commerce transaction has completed before accepting a submitted form. As a result, an unauthenticated visitor can submit a payment-required form, trigger the plugin’s confirmation logic, and receive a confirmation page and notification emails even though no order exists in PayPal and no payment has been recorded. The consequence is loss of expected revenue and the risk of unverified data being entered into the website backend, as the form data is processed without knowing the payment status.

WordPress sites running WPForms Lite in the versions 1.10.0.1 through 2.0.2.1 are affected. Sites configured to use the PayPal Commerce gateway on these forms are susceptible.

In CVSS terms the flaw scores 5.3, indicating moderate severity. The EPSS score is below 1%, reflecting a low but non-zero likelihood that exploitation occurs in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw simply by navigating to a public payment-enabled form and submitting it; no authentication or code execution is required. This logical flaw, categorized as CWE‑345, effectively bypasses server-side payment verification, making exploitation straightforward and the potential impact monetary loss and unauthorized data handling.