CVE Database /
CVE-2023-2877
CVE · High
CVE-2023-2877 — Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 6.3.1
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2023-2877
|
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 6.3.1 |
Incorrect Authorization |
High
8.8
|
< 6.3.1
|
6.3.1 |
2023-05-31 |
—
|
CVE-2023-2877
The Formidable Forms plugin contains a capability check bypass in its screen_page() and can_install_addon_api() functions that permits authenticated users with subscriber-level access to install and activate arbitrary plugins through version 6.3. An attacker can extract a valid token from the welcome page and use it to deploy malicious plugins, potentially enabling remote code execution. This vulnerability affects all versions up to and including 6.3, with the flaw being remedied in version 6.3.1.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings