What’s Vulnerable › Vulnerabilities

CVE-2017-20194: Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-10-16 · updated 2026-06-17
• Weakness: CWE-200

Description

The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frm_forms_preview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form.

Affected products

• strategy11team Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: through 2.05.03

References

• https://klikki.fi/formidable-forms-vulnerabilities/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c7600fe1-94e4-4e3e-a9a6-ff3589813715?source=cve

Get alerted when CVE-2017-20194 or the next vulnerability affects your stack