CVE WatchJul 24, 2026

CVE-2026-39707

Missing Authorization vulnerability in ZealousWeb Accept PayPal Payments using Contact Form 7 contact-form-7-paypal-extension allows Exploit

CVSS

5.3

Medium

EPSS

0.2%

KEV

—

Exploit Today

0-100

Published: Apr 8, 2026 · Last modified: Jul 24, 2026 · CWE-862

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-07-132026-08-10

Technical description

Missing Authorization vulnerability in ZealousWeb Accept PayPal Payments using Contact Form 7 contact-form-7-paypal-extension allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accept PayPal Payments using Contact Form 7: from n/a through <= 4.0.4.

Official references

patchstack.comhttps://patchstack.com/database/Wordpress/Plugin/contact-form-7-paypal-extension/vulnerability/wordpress-accept-paypal-payments-using-contact-form-7-plugin-4-0-4-broken-access-control-vulnerability?_s_id=cve

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-703408.1 HIG

—

———Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.5h CVE-2026-658066.5 MED

—

———Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network.5h CVE-2026-629156.5 MED

—

———Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network.5h CVE-2026-619365.5 MED

—

———Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally.5h CVE-2026-591138.8 HIG

—

———Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.5h CVE-2026-403756.5 MED

—

———Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network.5h