its totally based on web applications functionalities.

for example web application have 3 templates for normal user creation .for premium users 10 templates

so ,try to bypass the premium feature to create more than 3.so like that when u bypassed this is vulnerability. creative vulnerabilities changes based on web application functionalities.