WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass on Paid Forms

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Payment Bypass in versions 1.10.0.1 through 2.0.2.1. This is due to missing server-side enforcement that blocks submission when no PayPal payment identifier is present, and a conditional check that allowed form errors to be suppressed when the PayPal Commerce field was not marked required in the form builder. This makes it possible for unauthenticated attackers to submit a PayPal Commerce payment form without completing payment, receiving the form confirmation and notification emails without any order existing at PayPal. A form must have a PayPal Commerce payment field.

This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: WPForms 2.0.2.2 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts