CVE-2023-2877: Formidable Forms < 6.3.1 - Subscriber+ Remote Code Execution

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 22.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-06-27 · updated 2026-06-17

Description

The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing add-ons. This allows a user with a role as low as Subscriber to install and activate arbitrary plugins of arbitrary versions from the WordPress.org plugin repository onto the site, leading to Remote Code Execution.

Affected products

Formidable Forms: before 6.3.1 — fixed in 6.3.1

How to fix

Upgrade to a fixed version: Formidable Forms 6.3.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/33765da5-c56e-42c1-83dd-fcaad976b402
https://wpscan.com/vulnerability/33765da5-c56e-42c1-83dd-fcaad976b402

Get alerted when CVE-2023-2877 or the next vulnerability affects your stack