CVE-2026-4986

{"id": "CVE-2026-4986", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4986", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-09T13:15:26.089359Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "WPForms", "versions": [{"status": "affected", "version": "1.10.0.1", "lessThan": "1.10.0.5", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-09T06:16:53.797", "references": [{"url": "https://wpscan.com/vulnerability/1d99eed6-9a16-4d5a-90f9-ab604dfd5b92/", "source": "contact@wpscan.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before processing them, allowing unauthenticated attackers to forge webhook payloads and manipulate the payment state of arbitrary transactions."}, {"lang": "es", "value": "El plugin de WordPress WPForms anterior a la versi\u00f3n 1.10.0.5 no verifica la autenticidad de los eventos webhook entrantes de PayPal antes de procesarlos, lo que permite a atacantes no autenticados falsificar cargas \u00fatiles de webhook y manipular el estado de pago de transacciones arbitrarias."}], "lastModified": "2026-07-23T08:10:00.137", "sourceIdentifier": "contact@wpscan.com"}