A security researcher discovered an authentication failure in the WPForms PayPal Commerce webhook, which allowed a forged event to change the state of a matching payment record. The vulnerability occurred because the handler could process a supported event before verifying that PayPal was the sender. The researcher found that the affected flow performed steps out of order, processing the event and changing the payment state without first authenticating the sender. The issue was fixed in WPForms version 1.10.0.5 and is tracked as CVE-2026-4986. The researcher was surprised to learn that they were the 11th person to report the vulnerability, indicating that at least 11 researchers had independently discovered the issue. The researcher's write-up covers the vulnerable code path, local reproduction, and the patch, as well as the importance of duplicate reports. The researcher limited their testing to their own local environment and does not claim original credit for the discovery, having independently rediscovered and reported the issue. The researcher used an AI tool to help with editing and organizing the final article, which is available online. The discovery raises questions about how vendors should treat vulnerabilities when multiple reports are received, and whether duplicate reports should affect the urgency of the vendor's response. The researcher's experience highlights the importance of thorough security testing and the value of independent verification of vulnerabilities.