Formidable Forms CVE-2026-18331

No authentication is required to submit a form entry - the CVSS vector confirms PR:N. The critical precondition is that the attacker must forge the frm_user_id parameter to match a valid administrator's WordPress user ID; this ID is obtainable without authentication via the public WordPress REST API (/wp-json/wp/v2/users), which is enabled by default in most WordPress installations. The Formidable Forms plugin must be installed and active. Execution of the payload additionally requires that an administrator navigate to the form entries management page within the WordPress admin panel - the admin JavaScript on that page is the trigger mechanism. Sites that have disabled the WordPress REST API user enumeration endpoint or that restrict admin panel access by IP would face meaningfully higher exploitation difficulty. There is no dependency on a specific form configuration or non-default plugin setting; any active installation through 6.33.1 is vulnerable.

The CVSS 3.1 base score of 7.2 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N signals a high-priority network-exploitable flaw requiring no authentication. However, the UI:N designation warrants scrutiny: payload execution depends on an administrator visiting the injected entries page, which is UI:R by most interpretations of the CVSS specification - an independent assessment places the score closer to 6.1 under UI:R. Regardless of scoring, the practical risk is elevated by two factors: admin user IDs are publicly discoverable via WordPress's REST API, eliminating any reconnaissance barrier, and the admin JavaScript executes the payload automatically on page load, minimizing the friction for exploitation once the admin navigates to the entries section as part of routine operations. No KEV listing and no confirmed public exploit code were present in the input data, and no EPSS score was provided. The scope change (S:C) is meaningful - successful exploitation grants script execution within the authenticated admin session, enabling actions such as admin account takeover, backdoor installation, or plugin manipulation. The real-world priority is high for any site running Formidable Forms through 6.33.1 with public REST API user enumeration enabled.

An unauthenticated attacker queries the public WordPress REST API endpoint /wp-json/wp/v2/users to enumerate administrator account IDs on the target site. The attacker then submits a Formidable Forms entry with the frm_user_id parameter forged to match the administrator's ID and a crafted XSS payload embedded in a form field. When the administrator later navigates to the Formidable Forms entries management page in the WordPress admin panel, the plugin's admin JavaScript automatically decodes and executes the stored payload within the administrator's authenticated session, enabling actions such as creating a rogue admin account or installing a backdoor plugin. No public exploit code was identified in the provided data, but the attack path is technically straightforward.