Cross-Site Request Forgery Vulnerability in PayPal Forms Plugin for WordPress

CVE-2025-10309

What is CVE-2025-10309?

The PayPal Forms plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF), affecting all versions up to and including 1.0.3. The vulnerability arises from the lack of nonce validation in the form creation and management functions. As a result, unauthenticated attackers can forge requests to create new PayPal forms or modify payment settings if they are able to deceive a site administrator into executing an action, such as clicking on a malicious link. This flaw emphasizes the importance of implementing robust validation mechanisms to protect against unauthorized access and modifications.

References