The CP Contact Form with PayPal plugin for WordPress versions up to and including 1.3.56 has a Missing Authorization vulnerability. This flaw allows unauthenticated attackers to send forged payment notification requests to an exposed IPN-like endpoint, marking form submissions as paid without actual payment verification.