CVE-2023-2877: Formidable Forms < 6.3.1 - Subscriber+ Remote Code Execution
The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing add-ons. This allows a user with a role as low as Subscriber to install and activate arbitrary plugins of arbitrary versions from the WordPress.org plugin repository onto the site, leading to Remote Code Execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-2877?
CVE-2023-2877 has been classified with a medium severity due to the potential for unauthorized plugin installations.
How do I fix CVE-2023-2877?
To fix CVE-2023-2877, update the Formidable Forms plugin to version 6.3.1 or later.
Who is affected by CVE-2023-2877?
CVE-2023-2877 affects users of the Formidable Forms WordPress plugin versions prior to 6.3.1.
What types of users can exploit CVE-2023-2877?
CVE-2023-2877 can be exploited by users with as low a role as Subscriber.
What kind of vulnerabilities does CVE-2023-2877 allow?
CVE-2023-2877 allows unauthorized users to install and activate arbitrary plugins, potentially leading to further exploits.