Non notée
CVE-2023-2877 The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL…
Description
The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing add-ons. This allows a user with a role as low as Subscriber to install and activate arbitrary plugins of arbitrary versions from the WordPress.org plugin repository onto the site, leading to Remote Code Execution.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Formidable Forms 6.3 | premières → < 6.3.1 | 6.3.1 |
Références
- wpscan.com wpscan.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Formidable Forms
Les 8 CVE de Formidable Forms →
CVE-2026-85642
The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the…
7.5
Élevée
CVE-2026-19857
The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress…
4.8
Moyenne
CVE-2026-85641
The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user…
4.3
Moyenne
CVE-2026-11361
The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription…
5.9
Moyenne