Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before processing them, allowing unauthenticated attackers to forge webhook payloads and manipulate the payment state of arbitrary transactions.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-22 | 2 | Disclosure1General1 |
| 2026-09-13 | 1 | General1 |
I was reporter #11 for a WPForms PayPal webhook vulnerability (CVE-2026-4986) https://blog.himanshuanand.com/2026/07/reporter-11-10-people-found-the-wpforms-paypal-bug-before-me-cve-2026-4986/
Post summary
The text announces the author's role as the 11th reporter of CVE-2026-4986 but provides no technical or exploit-related information.
Reporter #11. I found a WPForms PayPal webhook that processed unauthenticated payment events. Ten researchers had already reported it. The code bug was small. The rediscovery signal was not. CVE-2026-4986 https://blog.himanshuanand.com/2026/07/reporter-11-10-people-found-the-wpforms-paypal-bug-before-me-cve-2026-4986/
Post summary
The post announces CVE-2026-4986, a WPForms PayPal webhook flaw that allows unauthenticated payment events; no PoC, exploit, patch, or active exploitation evidence is provided.
I was reporter #11 for a WPForms PayPal webhook vulnerability (CVE-2026-4986) https://blog.himanshuanand.com/2026/07/reporter-11-10-people-found-the-wpforms-paypal-bug-before-me-cve-2026-4986/
Post summary
The post mentions the CVE and links to a blog article but provides no technical details or evidence of exploitation.