CVE-2023-1405 Formidable Forms < 6.2 - Unauthenticated PHP Object Injection
Unauthenticated attackers can achieve PHP Object Injection via unsafe deserialization in the Formidable Forms plugin, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-1405?
CVE-2023-1405 is a high-severity unsafe deserialization vulnerability in Unknown Formidable Forms, published on 16 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Formidable Forms WordPress plugin before 6.2 unserializes user input, which could allow anonymous users to perform PHP Object Injection when a suitable gadget is present.
Weakness: CWE-502
Which versions are affected by CVE-2023-1405?
It affects 1 product.
Products include Strategy11 Formidable Forms.
How do I fix CVE-2023-1405?
No fix has been published for CVE-2023-1405 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2023-1405 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-1405 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Unknown Formidable Forms
- CVE-2023-2877 Formidable Forms < 6.3.1 - Subscriber+ Remote Code Execution
- CVE-2024-11188 Cross-site scripting in Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
- CVE-2024-0660 Formidable Forms <= 6.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-23522 WordPress Formidable Forms plugin <= 6.7 - Content Injection vulnerability
- CVE-2024-6725 Formidable Forms <= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Sources
Also known as GHSA-wfgq-9f7c-xcw5.