CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership activation — without being charged.
Explanation of Vulnerability in Simple Terms
Formidable Forms versions before 6.32.1 contain an integrity vulnerability allowing attackers to modify data without authentication. The attack requires specific network conditions and no user interaction. The vulnerability does not expose sensitive information or disrupt availability, but allows unauthorized alteration of form submissions or related data.
What an attacker can do
Modify form data or submissions without logging in.
Potential impact on your site
Form submissions or stored data could be altered by unauthorized parties.
Conditions required to exploit
Network access; specific conditions must be met (high attack complexity).
Key dates
External resources
