CVE-2025-13384

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13384", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-18T20:44:10.384Z", "datePublished": "2025-11-22T07:29:19.553Z", "dateUpdated": "2026-04-08T16:57:57.779Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:57:57.779Z"}, "affected": [{"vendor": "codepeople", "product": "CP Contact Form with PayPal", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.3.56", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The CP Contact Form with PayPal plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.56. This is due to the plugin exposing an unauthenticated IPN-like endpoint (via the 'cp_contactformpp_ipncheck' query parameter) that processes payment confirmations without any authentication, nonce verification, or PayPal IPN signature validation. This makes it possible for unauthenticated attackers to mark form submissions as paid without making actual payments by sending forged payment notification requests with arbitrary POST data (payment_status, txn_id, payer_email)."}], "title": "CP Contact Form with PayPal <= 1.3.56 - Missing Authorization to Unauthenticated Arbitrary Payment Confirmation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6639c3d8-8f26-4ee5-8c4b-2efcf34668a2?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/cp-contact-form-with-paypal/tags/1.3.56/cp_contactformpp_functions.php#L541"}, {"url": "https://plugins.trac.wordpress.org/browser/cp-contact-form-with-paypal/tags/1.3.56/cp_contactformpp_functions.php#L877"}, {"url": "https://plugins.trac.wordpress.org/browser/cp-contact-form-with-paypal/tags/1.3.56/cp_contactformpp_functions.php#L925"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3399104%40cp-contact-form-with-paypal&new=3399104%40cp-contact-form-with-paypal&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "timeline": [{"time": "2025-11-19T15:27:59.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-21T18:50:24.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-24T19:30:54.084389Z", "id": "CVE-2025-13384", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-24T19:31:03.108Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13384", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-24T19:30:54.084389Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-24T19:30:58.849Z"}}], "cna": {"title": "CP Contact Form with PayPal <= 1.3.56 - Missing Authorization to Unauthenticated Arbitrary Payment Confirmation", "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}}], "affected": [{"vendor": "codepeople", "product": "CP Contact Form with PayPal", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.3.56"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-19T15:27:59.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-21T18:50:24.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6639c3d8-8f26-4ee5-8c4b-2efcf34668a2?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/cp-contact-form-with-paypal/tags/1.3.56/cp_contactformpp_functions.php#L541"}, {"url": "https://plugins.trac.wordpress.org/browser/cp-contact-form-with-paypal/tags/1.3.56/cp_contactformpp_functions.php#L877"}, {"url": "https://plugins.trac.wordpress.org/browser/cp-contact-form-with-paypal/tags/1.3.56/cp_contactformpp_functions.php#L925"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3399104%40cp-contact-form-with-paypal&new=3399104%40cp-contact-form-with-paypal&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The CP Contact Form with PayPal plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.56. This is due to the plugin exposing an unauthenticated IPN-like endpoint (via the 'cp_contactformpp_ipncheck' query parameter) that processes payment confirmations without any authentication, nonce verification, or PayPal IPN signature validation. This makes it possible for unauthenticated attackers to mark form submissions as paid without making actual payments by sending forged payment notification requests with arbitrary POST data (payment_status, txn_id, payer_email)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:57:57.779Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13384", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:57:57.779Z", "dateReserved": "2025-11-18T20:44:10.384Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-22T07:29:19.553Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "CP Contact Form with PayPal", "vendor": "codepeople", "versions": [{"lessThanOrEqual": "1.3.56", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The CP Contact Form with PayPal plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.56. This is due to the plugin exposing an unauthenticated IPN-like endpoint (via the 'cp_contactformpp_ipncheck' query parameter) that processes payment confirmations without any authentication, nonce verification, or PayPal IPN signature validation. This makes it possible for unauthenticated attackers to mark form submissions as paid without making actual payments by sending forged payment notification requests with arbitrary POST data (payment_status, txn_id, payer_email)."}, {"lang": "es", "value": "El plugin CP Contact Form with PayPal para WordPress es vulnerable a la falta de autorizaci\u00f3n en todas las versiones hasta la 1.3.56, inclusive. Esto se debe a que el plugin expone un endpoint tipo IPN no autenticado (a trav\u00e9s del par\u00e1metro de consulta 'cp_contactformpp_ipncheck') que procesa confirmaciones de pago sin ninguna autenticaci\u00f3n, verificaci\u00f3n de nonce o validaci\u00f3n de firma IPN de PayPal. Esto permite a atacantes no autenticados marcar env\u00edos de formularios como pagados sin realizar pagos reales, enviando solicitudes de notificaci\u00f3n de pago falsificadas con datos POST arbitrarios (payment_status, txn_id, payer_email)."}], "id": "CVE-2025-13384", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13384", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-24T19:30:54.084389Z", "version": "2.0.3"}}]}, "published": "2025-11-22T08:15:44.647", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/cp-contact-form-with-paypal/tags/1.3.56/cp_contactformpp_functions.php#L541"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/cp-contact-form-with-paypal/tags/1.3.56/cp_contactformpp_functions.php#L877"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/cp-contact-form-with-paypal/tags/1.3.56/cp_contactformpp_functions.php#L925"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3399104%40cp-contact-form-with-paypal&new=3399104%40cp-contact-form-with-paypal&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6639c3d8-8f26-4ee5-8c4b-2efcf34668a2?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:02:50.547221+00:00", "value": {"mitigation_remediation": ["Update CP Contact Form with PayPal to the latest version that removes the unauthenticated IPN endpoint or adds proper authentication and signature verification.", "If an immediate update is not possible, block or disable the cp_contactformpp_ipncheck endpoint by using web\u2011application\u2011firewall rules or .htaccess directives to reject unauthenticated POST requests to that query parameter.", "In code, add server\u2011side checks for PayPal IPN signatures or a site\u2011specific nonce before processing payment confirmations, ensuring only legitimate notifications are accepted."], "summary": {"action": "Apply Patch", "impact": "Unauthorized Payment Confirmation"}, "threat_synthesis": {"affected_systems": "WordPress sites running CP Contact Form with PayPal through version 1.3.56 or earlier are impacted. The vulnerability is present in all releases of the plugin with a public endpoint that accepts unauthenticated POST data and does not verify a PayPal signature or nonce.", "description_and_impact": "The CP Contact Form with PayPal plugin contains a missing authorization flaw that allows an unauthenticated attacker to trigger payment confirmation logic without providing valid PayPal IPN credentials. By sending a forged request containing arbitrary POST data (payment_status, txn_id, payer_email) to the unprotected cp_contactformpp_ipncheck endpoint, an attacker can mark any form submission as paid even though no actual transaction has taken place. This could enable financial fraud, inflate metrics, or trigger downstream processes that rely on confirmed payments.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity. The EPSS score is below 1%, suggesting a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need only network access to the site and the ability to send HTTP POST requests to the cp_contactformpp_ipncheck query string. No authentication or special test prerequisites are required, making the vulnerability readily exploitable by automated scripts."}}}}, "created": "2025-11-24T09:08:19.782880+00:00", "updated": "2026-04-21T18:15:36.364454+00:00", "vendors": ["codepeople", "codepeople$PRODUCT$cp_contact_form_with_paypal", "wordpress", "wordpress$PRODUCT$wordpress"]}