Contact Form 7 – PayPal & Stripe Add-on Security & Risk Analysis

The 'contact-form-7-paypal-add-on' v2.4.6 plugin presents a mixed security posture. While it shows some good practices such as a reasonable number of nonce and capability checks relative to its entry points, and a complete lack of critical or high-severity vulnerabilities in its history, there are significant concerns arising from the static analysis. The presence of 6 AJAX handlers and 2 REST API routes, with a concerning 4 and 2 respectively lacking authentication checks, creates a substantial attack surface that is not adequately protected. Furthermore, 3 out of 8 analyzed taint flows having unsanitized paths, although not leading to critical or high severity issues in this scan, suggest a potential for vulnerability if exploited in conjunction with the unprotected entry points.

The plugin's vulnerability history reveals 5 medium-severity CVEs, primarily related to Cross-Site Scripting and Cross-Site Request Forgery. The fact that all previously known vulnerabilities are patched is positive. However, the recurring nature of these vulnerability types, especially XSS and CSRF, in conjunction with the identified unprotected entry points and unsanitized taint flows, indicates a historical tendency towards input validation and output escaping weaknesses that could be re-introduced or exploited. The last vulnerability was dated in 2025, implying it's a recent issue that has been addressed.

In conclusion, while the plugin has addressed past vulnerabilities and incorporates some security features, the significant number of unprotected AJAX and REST API endpoints, coupled with identified unsanitized taint flows, makes it a notable risk. The potential for attackers to leverage these unprotected entry points to trigger vulnerabilities, even if currently medium in severity, is a primary concern. Organizations using this plugin should prioritize securing these exposed endpoints or consider alternatives if further mitigation is not feasible.