Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder, 75b65b2898836c07534e8dd16dc8098b32d7a4b8
- CVE, Research URL
- Home page URL
- Application
- Published on
- May 31, 2023
- Research Description
- Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder [formidable] < 6.3.1 Formidable Forms <= 6.3 - Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation The Formidable Forms plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation due to a missing capability check on the screen_page() and can_install_addon_api() functions in versions up to, and including, 6.3. This makes it possible for authenticated attackers, with minimal permissions such as subscribers to retrieve a valid token from the welcome page, and then subsequently install and activate arbitrary plugins onto the site utilizing that key. This can easily be leveraged by attackers to achieve remote code execution as they simply need to install another plugin with a vulnerability or functionality that will aid in further exploitation.
- Affected versions
-
max 6.3.1.
- Status
-
vulnerable