The Formidable Forms WordPress plugin before version 6.32.1 does not properly verify the status of PayPal subscription payments before marking them as complete. This insufficient verification (CWE-345) enables unauthenticated attackers to bypass payment requirements and trigger paid form actions, including digital content access, license delivery, and membership activation, without paying. The vulnerability has a CVSS 3.1 base score of 5.9 (medium severity) with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts integrity but not confidentiality or availability.

An attacker can bypass payment verification for PayPal subscriptions, allowing unauthorized access to paid features such as digital content, licenses, and memberships without payment. This impacts the integrity of the payment and access control mechanisms but does not affect confidentiality or availability.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling PayPal subscription payment features or applying custom validation to verify payment status before granting access to paid actions.