How it was found

Summary:

Hello Team, I truly hope it treats you awesomely on your side of the screen :)

due to improper handling of payment methods, an attacker can easily bypass the payment and benefit from a paid plan.

Steps To Reproduce:

1. Log to your account
2. Go to the billing page
3. Fill in the address tab
4. Go to the next tab Payment Card
5. ==Now the interesting step Make sure you don't have any money on your credit card==
6. Chose Email outreach and wait until you get a notification that the payment is failed
7. Next increase the number of seats for example 50
8. Again you will get a notification that the payment is failed
9. Now Cancel the subscription
10. Now I can use the paid features without paying anything.

POC

{{F1538593}}

Impact

I think the impact is pretty obvious, an attacker can use paid plans without paying anything.

if you need more info feel free to ping me

best Regards @omarelfarsaoui