CyberSecurity News

I was reporter #11 for a WPForms PayPal webhook vulnerability

Hacker News

· July 22, 2026

AI summary

A vulnerability in WPForms' PayPal webhook was discovered by 10 people before the author, who was the 11th reporter. The bug has been assigned the identifier CVE-2026-4986. The author has written about their experience as the 11th reporter of this issue on their blog. The post has been shared on Hacker News, where it has garnered some points but no comments so far. The vulnerability and the author's account can be found through the provided article and comments URLs.

Vulnerabilities mentioned

CVE-2026-4986

MEDIUM

CVSS 5.3

The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before processing them, allowing unauthenticated attackers to forge webhook payloads and manipulate the payment state of arbitrary transactions.

Read the full article at Hacker Newsblog.himanshuanand.com/2026/07/reporter-11-10-people-found-the-wpforms-paypal-bug-before-me-cve-2026-4986/

This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to Hacker News.