CVE-2023-2877 — Formidable Forms < 6.3.1 - Subscriber+ Remote Code Execution
The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing add-ons. This allows a u…
Published: 2023-06-27 · CVSS: Unscored
The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing add-ons. This allows a user with a role as low as Subscriber to install and activate arbitrary plugins of arbitrary versions from the WordPress.org plugin repository onto the site, leading to Remote Code Execution.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7