Loading story…
A vulnerability tracked as CVE-2026-4986 affected WPForms before version 1.10.0.5, allowing the plugin's PayPal Commerce webhook handler to change the state of a matching payment record before confirming that the request actually originated from PayPal. The flaw was described as an authentication failure in the webhook processing flow: after a request reached the publicly accessible endpoint, the handler could accept a supported event and update payment status prior to sender verification.
The researcher who disclosed the issue said the exposed webhook URL was not itself the bug; the security failure was the order of operations, which should have authenticated the sender first, validated the event second, and only then modified payment state. WPForms fixed the issue in 1.10.0.5, and the researcher said triage identified them as reporter number 11, indicating that multiple independent researchers had found the same trust-validation weakness even though duplicate reports do not by themselves show active exploitation.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A researcher disclosed that triage informed them they were reporter number 11 for the WPForms PayPal webhook vulnerability, indicating multiple independent submissions of the same flaw. The researcher noted that duplicate reports do not by themselves demonstrate exploitation.
A vulnerability tracked as CVE-2026-4986 affected WPForms versions before 1.10.0.5, where the PayPal Commerce webhook handler could change payment state before verifying the request came from PayPal. The issue was fixed in WPForms 1.10.0.5.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourceblog.himanshuanand.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities were disclosed in widely used WordPress form plugins, exposing sites to unauthenticated attacks that can lead to full server compromise. **CVE-2026-4347** affects **MW WP Form** through version `5.1.0` and stems from insufficient file path validation in `generate_user_filepath` and `move_temp_file_to_upload_dir`. An attacker can move arbitrary files on the server without authentication, and if a sensitive file such as `wp-config.php` is relocated, the flaw can be leveraged for remote code execution. Exploitation requires a form with a file upload field and the **Saving inquiry data in database** option enabled; the issue is tracked as **CWE-22**.
Jun 29, 2026
A critical vulnerability in the **Forminator Forms** WordPress plugin exposed roughly **600,000 sites** to unauthenticated arbitrary file upload and potential remote code execution. Tracked as `CVE-2026-15748`, the flaw affects all versions through **1.56.1** and can be exploited when a form includes both a **File Upload** field and a **Select** field. Researchers said attackers could forge upload metadata and bypass file-type checks in the plugin's `handle_file_upload()` logic to upload malicious **PHP** files. In default configurations, uploaded files are usually stored in a directory protected by `.htaccess`, which can block direct execution, but sites using a custom upload storage root may lack that safeguard and be fully compromised. The vendor patched the issue in **Forminator Forms 1.56.2**. Separate reporting also highlighted another critical WordPress plugin issue: **User Profile Builder** `CVE-2026-15826`, an authentication bypass fixed in **3.16.5** that could let unauthenticated attackers log in as **user ID 1** when **Automatically Log In** is enabled.
Aug 25, 2026
Attackers are actively exploiting **CVE-2026-27540**, a critical CVSS 9.8 unauthenticated arbitrary-file-upload flaw in the WordPress/WooCommerce Wholesale Lead Capture plugin. Versions through `2.0.3.1` trust attacker-controlled file-type settings in the public wholesale-registration form, allowing attackers to upload executable PHP files without logging in and gain remote code execution on the hosting server. Exploitation has reportedly persisted for months, and Wordfence has blocked more than 100,000 attempts against roughly 6,000 active installations. Affected operators should upgrade to version `2.0.3.2` and investigate for PHP webshells, unauthorized administrator accounts, altered checkout content, persistence mechanisms, suspicious outbound connections, and related log activity.
Sep 16, 2026