EUVD-2026-54303
GHSA-ww4h-86qv-rmr8
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-reachable callback endpoint requires no auth; AC:H reflects non-trivial PayPal IPN manipulation; integrity-only impact captures unauthorized entitlement grant without data exposure.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment and trigger paid form actions - such as digital content access, license delivery, and membership activation - without being charged.
AnalysisAI
Payment logic bypass in the Formidable Forms WordPress plugin before 6.32.1 enables unauthenticated remote attackers to complete PayPal subscription flows without being charged. The plugin fails to properly validate PayPal subscription payment status before marking it complete, allowing attackers to trigger all downstream paid-form actions - including digital content delivery, license key issuance, and membership activation - without a valid transaction. No public exploit or KEV listing exists at time of analysis, but the business logic nature of the flaw and its zero-authentication requirement make it accessible to motivated, non-technical attackers once the code path is understood.
Technical ContextAI
Formidable Forms is a widely-used WordPress form builder plugin that natively integrates with PayPal for subscription-based payment collection. The vulnerability is a business logic flaw in the payment lifecycle handler: the plugin advances a subscription to a 'complete' state without cryptographically or programmatically verifying the corresponding PayPal payment status - likely via IPN (Instant Payment Notification) or webhook callback - before triggering post-payment form actions. No CWE was formally assigned, but the flaw maps conceptually to CWE-345 (Insufficient Verification of Data Authenticity) and CWE-287 (Improper Authentication) in the context of payment flow integrity. Affected versions span the entire version history up to but not including 6.32.1, per EUVD-2026-54303 range ['Formidable Forms 0 <6.32.1']. No CPE string was provided in the source data.
RemediationAI
Upgrade Formidable Forms to version 6.32.1 or later, which contains the vendor-released patch addressing this payment validation flaw. The fix is confirmed available per the WPScan advisory at https://wpscan.com/vulnerability/dbee54f6-898f-436a-9f72-f2248931ea12/. As an interim compensating control before patching, site administrators can disable the PayPal subscription payment gateway within the Formidable Forms plugin settings - this eliminates the vulnerable code path entirely but will suspend payment collection for affected forms. A less disruptive alternative is to implement server-side validation of PayPal IPN signatures via a custom WordPress action hook or WAF rule, rejecting any form completion requests that lack a verified PayPal transaction ID; this reduces exposure without disabling the integration, but requires custom development and carries a risk of false positives if PayPal callback formats vary. Patching to 6.32.1 remains the only fully reliable remediation.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today