Login Request a demo
Medium severity · published Jan 30, 2025
CVE-2024-13758
CP Contact Form with PayPal <= 1.3.52 - Cross-Site Request Forgery
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
The CP Contact Form with PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.52. This is due to missing or incorrect nonce validation on the cp_contact_form_paypal_check_init_actions() function. This makes it possible for unauthenticated attackers to add discount codes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
CP Contact Form with PayPal · codepeople
through 1.3.52 · source: vendor
CC
CP Contact Form · Dwbooster
before 1.3.53 · source: NVD
Affected product
CC
CP Contact Form with PayPal
codepeople
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-13758
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-13758
Product
https://plugins.trac.wordpress.org/browser/cp-contact-form-with-paypal/trunk/cp_contactformpp_functions.php#L616
Patch
https://plugins.trac.wordpress.org/changeset/3230873/
Product
https://wordpress.org/plugins/cp-contact-form-with-paypal/#developers
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/495183b6-dc7c-4ff7-bc99-fc05a10d1269?source=cve
More from CP Contact Form with PayPal
8.8
CVE-2023-27460
WordPress CP Contact Form with PayPal plugin <= 1.3.34 - Missing Authorization Leading To Feedback Submission vulnerability
8.8
CVE-2015-9233
The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.php and…
8.5
CVE-2026-32433
WordPress CP Contact Form with Paypal plugin <= 1.3.61 - SQL Injection vulnerability
7.5
CVE-2025-13384
CP Contact Form with PayPal <= 1.3.56 - Missing Authorization to Unauthenticated Arbitrary Payment Confirmation
6.1
CVE-2019-14784
The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition