CVE-2025-13384: 
WordPress vulnerability analysis and mitigation

CVE-2025-13384 is a Missing Authorization vulnerability (CWE-862) in the CP Contact Form with PayPal plugin for WordPress, developed by CodePeople. The flaw affects all versions up to and including 1.3.56 and allows unauthenticated attackers to forge PayPal IPN (Instant Payment Notification) confirmations, marking form submissions as paid without completing actual payments. It was published on November 22, 2025, and carries a CVSS v3.1 base score of 7.5 (High) (Wordfence, Red Hat CVE).

The root cause is a missing authorization check (CWE-862) on an IPN-like endpoint exposed via the cp_contactformpp_ipncheck query parameter in the plugin's cp_contactformpp_functions.php file (lines ~541, ~877, ~925). This endpoint processes payment confirmation POST requests without requiring authentication, nonce verification, or validation of PayPal's IPN signature, meaning any unauthenticated HTTP client can trigger it. An attacker can craft a POST request with arbitrary payment_status, txn_id, and payer_email fields to simulate a successful PayPal payment notification (Wordfence, WordPress Trac).

Successful exploitation allows unauthenticated attackers to fraudulently mark any form submission as paid, effectively bypassing the payment requirement entirely. This results in a high integrity impact — attackers can obtain goods, services, or access gated by payment without completing a real transaction. There is no confidentiality or availability impact, but the financial and reputational damage to site operators accepting payments through this plugin can be significant (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the CP Contact Form with PayPal plugin (version ≤ 1.3.56) by scanning for plugin-specific assets (e.g., /wp-content/plugins/cp-contact-form-with-paypal/) or using tools like WPScan.
2. Identify target form: Browse the target site to locate a contact form powered by the plugin that requires payment, and note the form submission ID or relevant identifiers from the page source or prior form submission.
3. Craft forged IPN request: Construct an HTTP POST request to the WordPress site's URL with the cp_contactformpp_ipncheck query parameter set (e.g., https://target.com/?cp_contactformpp_ipncheck=1), including POST body fields such as payment_status=Completed, txn_id=<arbitrary_transaction_id>, and payer_email=<arbitrary_email>.
4. Submit forged notification: Send the crafted POST request without any authentication headers or cookies. The plugin processes the request as a legitimate PayPal IPN callback and marks the associated form submission as paid.
5. Verify outcome: Confirm that the form submission is now flagged as paid in the WordPress admin panel or that the expected post-payment action (e.g., confirmation email, access grant) has been triggered (Wordfence, WordPress Trac).

• Network: Unexpected POST requests to WordPress URLs containing the query parameter cp_contactformpp_ipncheck originating from IP addresses not associated with PayPal's IPN servers (PayPal IPN originates from known PayPal IP ranges).
• Logs: WordPress or web server access logs showing POST requests to /?cp_contactformpp_ipncheck=1 (or similar) from unauthenticated, non-PayPal sources; repeated requests with varying txn_id values.
• Application: Form submissions in the CP Contact Form with PayPal admin panel marked as "paid" with transaction IDs that do not correspond to real PayPal transactions; mismatched or nonsensical payer_email values in submission records.
• Database: WordPress database entries in form submission tables showing payment_status=Completed with txn_id values that cannot be verified against actual PayPal transaction records.

Site administrators should update the CP Contact Form with PayPal plugin to a version beyond 1.3.56 that includes the patch introduced in changeset 3399104 (WordPress Trac Changeset). As a temporary workaround, administrators can use a web application firewall (WAF) rule to block POST requests containing the cp_contactformpp_ipncheck query parameter from non-PayPal IP addresses. Additionally, restricting access to the WordPress site's front-end IPN endpoint via server-level IP allowlisting (permitting only PayPal's documented IPN IP ranges) can reduce exposure until the plugin is updated (Wordfence).

The vulnerability was reported by Wordfence and received standard coverage across security aggregation platforms including VulDB, CVEFeed, and CIRCL. CISA included it in its weekly vulnerability summary bulletin for the week of November 17, 2025 (CISA Bulletin). Social media activity was limited to automated CVE notification accounts on Bluesky and Mastodon, with no notable researcher commentary or vendor statements beyond the Wordfence advisory (Red Hat CVE).