Reporter #11: Inside the Webhook Vulnerability That Exposed WPForms and Ignited a Security Feud

A glaring security flaw inside one of WordPress's most popular form plugins has exposed a widening rift between independent vulnerability researchers and overloaded software vendors.

A security engineer examining the WPForms PayPal Commerce integration uncovered a catastrophic authentication failure tracked as CVE-2026-4986. The issue centers on public webhooks—the digital doorways designed to allow payment processors like PayPal to notify e-commerce platforms when a transaction completes.

While public availability is mandatory for webhooks to function, the sequence of execution inside affected WPForms versions was completely inverted. Standard security protocols require a system to authenticate the sender first, validate the incoming payload second, and update the internal payment status third.

Instead, the plugin processed payload validation and updated internal database payment records before verifying whether the request actually originated from PayPal. In a local testing environment, the researcher successfully forged an unauthenticated request payload, sent it to the public endpoint, and altered matching payment records at will.

After assembling a rigorous local reproduction and documenting the flawed code path, the researcher submitted a formal vulnerability disclosure to the vendor. The response from triage was unexpectedly humbling: the researcher was official reporter number eleven.

While being reporter number eleven does not confirm that hackers exploited the bug in the wild, it establishes a troubling lower bound. At least eleven independent security pros stumbled upon the exact same logic failure through routine code reviews.

WPForms officially patched the vulnerability in version 1.10.0.5, but the disclosure ignited an intense debate across the cybersecurity sector regarding how software vendors handle duplicate bug submissions.

Some industry insiders argue that high duplicate report volume serves as critical intelligence. One commenter noted that if eleven separate researchers can easily discover a severe payment vulnerability in their spare time, automated scanning tools operated by cybercriminals have likely indexed it as well.

Others pointed to even more severe cases of vendor inaction. Another researcher revealed they were the 61st person to report an active Remote Code Execution flaw to a different major vendor, only for the critical vulnerability to sit unpatched for months.

Conversely, software maintainers argue that triage queues are currently overwhelmed by low-quality, AI-assisted write-ups and automated bounty submissions. Defenders of vendor workflows emphasize that high discovery numbers simply reflect an obvious code structure, not necessarily active exploitation, and maintainers must prioritize verified zero-day threats over queue volume.

As e-commerce store operators rush to update their WPForms installations, the cybersecurity community remains locked in debate over whether duplicate reports represent vital safety alarms or unmanageable background noise.

Our hosts dive deep into this exact security dilemma and deliver their final verdict on this week's episode of System Error.