CVE-2026-82844: CWE-345 Insufficient Verification of Data Authenticity in WPForms Lite
Description
CVE-2026-82844 is a vulnerability in the WPForms Lite WordPress plugin versions from 1.10.0.1 up to but not including 2.0.2.2. The plugin fails to verify server-side that a payment was completed before accepting form submissions using its PayPal Commerce gateway. This allows unauthenticated users to submit forms that appear paid without actually making any payment. As a result, form confirmations and notification emails are sent despite no payment being recorded or order existing at the payment provider.
CVSS v3.1
Score 5.3medium
Affected software
WPForms Lite
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The WPForms Lite plugin before version 2.0.2.2 contains an insufficient verification of data authenticity vulnerability (CWE-345) in its PayPal Commerce gateway integration. The plugin does not perform server-side verification that a payment transaction was successfully completed before accepting the form submission. Consequently, unauthenticated visitors can submit forms that trigger confirmation messages and notification emails without any actual payment being made or recorded by the payment provider.
Potential Impact
An attacker can bypass payment requirements on forms using the PayPal Commerce gateway, causing the system to treat unpaid submissions as paid. This leads to inaccurate order processing and potential financial loss or abuse of services that rely on payment confirmation. The vulnerability does not impact confidentiality or availability but affects the integrity of payment verification.
Mitigation Recommendations
A fixed version of WPForms Lite is available at 2.0.2.2 or later that addresses this issue. Users should upgrade to version 2.0.2.2 or newer to ensure proper server-side payment verification. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-31T08:27:15.187Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acf5e2e2cdf04f6566e4b1e
Added to database: 10/14/2026, 10:49:18 UTC
Last enriched: 10/14/2026, 11:04:09 UTC
Last updated: 10/14/2026, 11:08:20 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.