Unauthenticated Payment Bypass in Formidable Forms

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WPScan

Description

The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership activation — without being charged.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-11361

Affected Vendors & Products

Vendor	Product	Version / Range
formidableforms	formidable_forms	to 6.32.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Formidable Forms WordPress plugin before version 6.32.1 allows unauthenticated users to bypass PayPal subscription payment validation. By exploiting this flaw, users can mark a subscription as complete without actually making a payment, enabling access to paid features like digital content, licenses, or memberships for free.

Impact Analysis

If you use the affected Formidable Forms plugin, attackers could gain unauthorized access to paid features without paying. This could lead to financial losses from unpaid subscriptions, unauthorized content distribution, or compromised membership services. The impact depends on how the plugin is configured in your WordPress site.

Mitigation Strategies

Update the Formidable Forms WordPress plugin to version 6.32.1 or later to address the improper validation of PayPal subscription payments.

Hi! I’m here to help you understand CVE-2026-11361. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70