CVE-2025-13384 is a missing authorization vulnerability (CWE-862) in the CP Contact Form with PayPal plugin for WordPress. The plugin exposes an unauthenticated IPN-like endpoint via the 'cp_contactformpp_ipncheck' query parameter that processes payment confirmations without authentication, nonce verification, or PayPal IPN signature validation. This flaw allows unauthenticated attackers to send forged payment notification requests with arbitrary POST data (such as payment_status, txn_id, payer_email) to mark form submissions as paid without making real payments. The vulnerability affects all versions up to and including 1.3.56 and has a CVSS 3.1 base score of 7.5 (High severity).

Exploitation of this vulnerability enables attackers to fraudulently mark payment forms as paid without completing actual transactions. This compromises the integrity of payment processing and can lead to financial loss or abuse of services relying on the plugin's payment confirmation mechanism. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling the PayPal integration or the plugin entirely if feasible, or implement additional access controls or monitoring to detect and block unauthorized requests to the 'cp_contactformpp_ipncheck' endpoint.