The Contact Form 7 – PayPal & Stripe Add‑on contains a flaw in its IPN handler that authenticates the PayPal message but does not compare the transaction amount, currency, or receiver email to the values stored for the order before marking it complete. As a result, an unauthenticated attacker can trigger a minimal real payment with PayPal, craft a custom IPN that references an existing high‑value pending order, and cause the plugin to mark that order as paid. This is an example of insufficient verification of data authenticity (CWE‑345).

WordPress sites using the Contact Form 7 – PayPal & Stripe Add‑on from scottpaterson. All plugin versions up to and including 2.4.9 are vulnerable. No other vendors or product families are affected by this specific flaw.

The vulnerability has a CVSS score of 5.3, indicating moderate severity, and it is not listed in the CISA KEV catalog. The EPSS score is not available, so the current exploitation probability cannot be quantified. The likely attack vector involves an attacker sending a forged PayPal IPN after making a small real payment; given that the IPN handler offers no authentication for the payload beyond the basic POST‑back check, the vulnerability can be exploited by anyone who can reach the PayPal IPN endpoint on the target site.