CVE-2026-85641: Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' Parameter
The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in the admin entry view that would otherwise be removed, and to attribute their submission to an administrator who never made it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Formidable Forms (WordPress plugin)to a version that resolves this vulnerability.Fixed in 6.35 - Configuration
After upgrading, verify that Formidable Forms no longer allows unauthenticated visitors to set the 'updated_by' identifier for stored entry edits so that markup stripping/attribution logic is applied to the correct user.
Formidable Forms (WordPress plugin) updated_by identifier restriction = Restrict who can set the 'updated_by' identifier to prevent unauthenticated users from attributing submissions
Event History
Frequently Asked Questions
Which installations are affected?
Formidable Forms versions before 6.35 are affected. The issue concerns form submissions whose stored values are later viewed in the WordPress admin entry view.
Does exploitation require an account or elevated permissions?
No. An unauthenticated visitor can submit data that causes markup to be retained and rendered in the admin entry view.
What conditions make exploitation more likely?
An attacker needs a form submission path and must be able to influence the updated_by parameter. The vulnerable logic uses that identifier when deciding whether HTML should be stripped from stored entry values.
What is the practical impact for administrators?
Markup supplied by an unauthenticated visitor may render when an administrator views the affected entry. The submission can also be attributed to an administrator who did not edit it.