CVE-2023-2877 Formidable Forms < 6.3.1 - Subscriber+ Remote Code Execution

What is CVE-2023-2877?

CVE-2023-2877 is a high-severity missing authorization vulnerability in Unknown Formidable Forms, published on 27 Jun 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing add-ons. This allows a user with a role as low as Subscriber to install and activate arbitrary plugins of arbitrary versions from the WordPress.org plugin repository onto the site, leading to Remote Code Execution.

Which versions are affected by CVE-2023-2877?

It affects 1 product.

Products include Strategy11 Formidable Forms.

How do I fix CVE-2023-2877?

No fix has been published for CVE-2023-2877 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-2877 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-2877 exists.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Unknown Formidable Forms

• CVE-2023-1405 Formidable Forms < 6.2 - Unauthenticated PHP Object Injection High 7.5
• CVE-2024-11188 Cross-site scripting in Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder Medium 6.1
• CVE-2024-0660 Formidable Forms <= 6.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting Medium 6.1
• CVE-2024-23522 WordPress Formidable Forms plugin <= 6.7 - Content Injection vulnerability Medium 5.3
• CVE-2024-6725 Formidable Forms <= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting Medium 4.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2x7r-m54m-f2pf.