CVE-2024-0660: Formidable Forms <= 6.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.7.2. This is due to missing or incorrect nonce validation on the updatesettings function. This makes it possible for unauthenticated attackers to change form settings and add malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0660?
CVE-2024-0660 is classified as a high-severity vulnerability due to its potential impact on user data and application integrity.
How do I fix CVE-2024-0660?
To fix CVE-2024-0660, update the Formidable Forms plugin to version 6.8 or later, which includes proper nonce validation.
What kind of attack is CVE-2024-0660 associated with?
CVE-2024-0660 is associated with Cross-Site Request Forgery (CSRF) attacks, allowing unauthorized actions to be performed on behalf of logged-in users.
Which versions of Formidable Forms are affected by CVE-2024-0660?
CVE-2024-0660 affects all versions of the Formidable Forms plugin up to and including version 6.7.2.
What should I do if I cannot update to the newer version addressing CVE-2024-0660?
If updating is not possible, consider temporarily disabling the Formidable Forms plugin until a patch is applied to mitigate the vulnerability.