5.9
Medium
CVE-2026-11361 The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription…
Description
The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership activation — without being charged.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Formidable Forms 6.32 | earliest → < 6.32.1 | 6.32.1 |
Other CVEs of Formidable Forms
The 8 CVEs of Formidable Forms →
CVE-2026-85642
The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the…
7.5
High
CVE-2026-19857
The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress…
4.8
Medium
CVE-2026-85641
The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user…
4.3
Medium
CVE-2024-9768
The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could…
4.8
Medium