The Formidable Forms WordPress plugin before version 6.32.1 fails to properly verify the status of PayPal subscription payments before marking them as complete. This insufficient verification (CWE-345) permits unauthenticated attackers to bypass payment requirements and trigger paid form actions, potentially granting unauthorized access to paid digital content, license deliveries, and membership activations. The vulnerability has a CVSS 3.1 base score of 5.9, indicating a medium severity level. No official patch or remediation information is provided in the available data.

Exploitation of this vulnerability allows unauthenticated users to bypass payment controls and gain unauthorized access to paid features or content managed by the Formidable Forms plugin. This could lead to financial loss for site owners and unauthorized distribution of digital goods or services. There is no indication of impact on confidentiality or availability, but integrity of payment processing and access control is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements and apply updates once available. Until then, consider disabling PayPal subscription payment features or implementing additional verification controls to prevent unauthorized access.