---
id: CVE-2026-105990
title: >-
  The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7
  does not perform any authorization checks before exporting stored form
  submissions, allowing unauthenticated attackers to download the personal data
  (name, ema…
summary: >-
  The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7
  does not perform any authorization checks before exporting stored form
  submissions, allowing unauthenticated attackers to download the personal data
  (name, ema…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-200
published: '2026-10-10'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T20:36:00.850'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-105990'
references:
  - url: 'https://wpscan.com/vulnerability/211d7613-a7e0-45f9-b262-66651aa4f535/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
epss: 0.00251
epssPercentile: 0.16607
ingestedAt: '2026-10-10T06:24:42.863Z'
product: Accept PayPal Payments using Contact Form 7
affected:
  - accept_paypal_payments_using_contact_form_7 < 4.0.7
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-10T12:03:24.468687Z'
---

## Overview

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data (name, email, telephone, postal address, message) and payment metadata of everyone who submitted a payment form.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.