CVE-2026-9189 affects the Contact Form 7 – PayPal & Stripe Add-on plugin for WordPress, allowing payment bypass due to insufficient verification of IPN data authenticity. While the plugin correctly posts back to PayPal to validate IPN messages, it fails to verify that the payment amount (mc_gross), currency (mc_currency), and receiver email match the stored order details. Instead, it trusts the attacker-controlled invoice field to complete the payment after only an integer cast, enabling attackers to mark orders as paid without tendering the full payment. This vulnerability impacts all versions up to and including 2.4.9.

An attacker can exploit this vulnerability to complete high-value orders without paying the required amount, resulting in financial loss to merchants using the affected plugin. The integrity of payment processing is compromised, but confidentiality and availability are not directly impacted. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the affected plugin or implementing additional verification controls outside the plugin to validate payment amounts and order details before marking orders as complete. Monitor vendor channels for updates.