WordPress · Wpforms · CVE-2026-7792
**Name of the Vulnerable Software and Affected Versions**
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More versions prior to 1.10.0.2
**Description**
The plugin is subject to insufficient verification of data authenticity. The PayPal Commerce webhook endpoint processes unauthenticated JSON webhook payloads without verifying the HMAC-SHA256 webhook signature, which is required to ensure the request originated from PayPal. The system only checks if the `event type` is whitelisted before sending attacker-controlled resource data to handlers that update payment records. This allows unauthenticated attackers with a valid `subscription id` to forge PayPal webhook events and modify subscription payment records, such as changing the `subscription status` to active to reactivate a cancelled or suspended subscription.
**Recommendations**
Update to a version later than 1.10.0.1.