CVE-2026-11361

MediumCVSS 5.9

Published: 06/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 07/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

4th percentile - higher than 4% of all known CVEs

Summary

The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete. This allows unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership activation — without being charged.

Risk Assessment

Attackers can obtain paid features without cost, leading to revenue loss and unauthorized access to content.

Recommendation

Update the Formidable Forms plugin to version 6.32.1 or later to ensure proper validation of PayPal subscription payment status.

Other vulnerabilities in Formidable Forms

CVE-2026-18331High
The Formidable Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frm_user_id' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. By forging frm_user_id to match an administrator's user ID, the attacker causes wp_kses_post() to be the only filter, and the script executes automatically.

Original NVD description (English source)

The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership activation — without being charged.