TLDR WPForms Lite is a WordPress form plugin with 5 million plus active installs. Versions 1.10.0.1 through 1.10.0.4 shipped a PayPal Commerce webhook handler that accepted events from anyone on the internet. No PayPal signature verification. No callback to PayPal before processing. Send a forged JSON body to /wp-json/wpforms/ppc/webhooks/ and the plugin would treat it like a real PayPal event. The impact was payment state manipulation. A forged PAYMENT.CAPTURE.COMPLETED event could mark a matching pending PayPal transaction as completed and fire downstream payment completed actions.