CVE-2023-2877: Formidable Forms < 6.3.1 - Subscriber+ Remote Code Execution
0.0
CVSS
Description
The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing add-ons. This allows a user with a role as low as Subscriber to install and activate arbitrary plugins of arbitrary versions from the WordPress.org plugin repository onto the site, leading to Remote Code Execution.
Classification
CVE ID: CVE-2023-2877
CVSS Base Severity: LOW
CVSS Base Score: 0.0
Affected Products
Vendor: Unknown
Product: Formidable Forms
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.25% (probability of being exploited)
EPSS Percentile: 64.13% (scored less or equal to compared to others)
EPSS Date: 2025-02-03 (when was this score calculated)