CVE-2025-10309: PayPal Forms <= 1.0.3 - Cross-Site Request Forgery
The PayPal Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce validation on the form creation and management functions. This makes it possible for unauthenticated attackers to create new PayPal forms and modify PayPal payment settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10309?
CVE-2025-10309 is classified as a medium severity vulnerability due to its potential to allow unauthorized form creation.
How do I fix CVE-2025-10309?
To fix CVE-2025-10309, update the PayPal Forms plugin to version 1.0.4 or higher to ensure proper nonce validation.
Who is affected by CVE-2025-10309?
All users of the PayPal Forms plugin for WordPress versions up to and including 1.0.3 are affected by CVE-2025-10309.
What type of vulnerability is CVE-2025-10309?
CVE-2025-10309 is a Cross-Site Request Forgery (CSRF) vulnerability due to missing nonce validation.
Can CVE-2025-10309 be exploited by unauthenticated users?
Yes, CVE-2025-10309 can be exploited by unauthenticated attackers, allowing them to create new forms.