Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder, CVE-2023-2877

CVE, Research URL: CVE-2023-2877
Home page URL: Security reports for Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
Application: Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
Published on: Jun 27, 2023
Research Description: The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing add-ons. This allows a user with a role as low as Subscriber to install and activate arbitrary plugins of arbitrary versions from the WordPress.org plugin repository onto the site, leading to Remote Code Execution.
Affected versions: max 6.3.1.
Status: vulnerable

Formidable Forms &#8211; Contact Form, Survey, Quiz, Payment, Calculator Form &amp; Custom Form Builder, CVE-2023-2877