Security Advisory

CVE-2023-2877

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2023-06-27 13:17:12

Last updated 2024-12-03 17:00:58

Assigner WPScan

State PUBLISHED

Description

The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing add-ons. This allows a user with a role as low as Subscriber to install and activate arbitrary plugins of arbitrary versions from the WordPress.org plugin repository onto the site, leading to Remote Code Execution.

← Browse all CVEs View on cve.org ↗