CVE-2023-2877

high · 8.8

The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing add-ons. This allows a user with a role as low as Subscriber to install and activate arbitrary plugins of arbitrary versions from the WordPress.org plugin repository onto the site, leading to Remote Code Execution.

8.8

CVSS

22.5%

EPSS (exploit prob.)

98th

EPSS percentile

2023-06-27

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Affected versions
strategy11	formidable_forms	< 6.3.1

Check a specific version with /api/v1/cve/match.

References

https://wpscan.com/vulnerability/33765da5-c56e-42c1-83dd-fcaad976b402
https://wpscan.com/vulnerability/33765da5-c56e-42c1-83dd-fcaad976b402

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-2877