CVE-2026-82844 Details
Description
The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its notification emails are sent even though no order exists at the payment provider and no payment is recorded.
A vulnerability exists in the WPForms Lite WordPress plugin in versions prior to 2.0.2.2. The issue arises because the plugin does not perform server-side verification of payment completion before accepting form submissions that use the PayPal Commerce gateway. This flaw allows unauthenticated users to submit forms that require payment without actually paying. As a result, confirmation messages are delivered, and notification emails are sent, even though no payment has been recorded and no order exists with the payment provider.
Users are advised to update the WPForms Lite WordPress plugin to version 2.0.2.2 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/e959ddad-8588-4136-8518-6b1d772a62c4/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| WPForms Lite | >= 1.10.0.1, <= 2.0.2.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |