CP Contact Form with PayPal < 1.1.6 - Cross-Site Request Forgery

Reaching this weakness in CP Contact Form with PayPal < 1.1.6 takes a caller who can reach the endpoint. Cross-site request forgery abuses the fact that browsers attach a victim's cookies to any request, so a state-changing action that only checks who you are, not whether you meant to act, can be triggered from another site.

An attacker who gets a logged-in user to load a crafted page can perform that action as them, with the impact scaling to whatever the victim's role is allowed to do. For CP Contact Form with PayPal the fix is 1.1.6: builds < 1.1.6 are affected, anything from 1.1.6 onward is not.