Formidable Forms EUVD-2026-113736

Requires an authenticated account at subscriber level or above that holds the delegable frm_view_forms capability; the attacker abuses a permission callback that validates only a shared token obtainable by such users, without checking install_plugins or activate_plugins, combined with insufficient URL prefix validation in validate_url_is_in_s3_bucket() reached via the 'file_url' parameter. A hard limiting precondition is that the site must be free-only: if Formidable Pro is installed, the site is NOT exploitable. Realistic risk is therefore concentrated on free-only Formidable Forms ≤6.35 sites that permit self-registration or otherwise grant low-trust users subscriber access.

This is a credible this-week priority rather than a high-CVSS-but-low-real-risk issue, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable flaw requiring only low-privileged authentication, and the C:H/I:H/A:H impact is justified because arbitrary plugin installation yields full code execution on the WordPress host. Decision signal is 'this_week' (vuln.today), and the issue was reported by Wordfence, a reputable WordPress security source. However, several real-world limiters pull the effective risk below the raw 8.8: exploitation requires an authenticated account at subscriber level or above (PR:L), and critically the site must be free-only - Formidable Pro installations are NOT affected, which excludes a meaningful fraction of serious deployments. No EPSS score, CISA KEV listing, or public exploit is present in the supplied data, so there is no evidence of active exploitation or widespread automated scanning yet. Net: patch within the week on affected free-only sites that allow self-registration or have low-trust accounts; the authenticated prerequisite and free-only condition make opportunistic mass exploitation less likely than the CVSS number alone suggests.

On a WordPress site running the free Formidable Forms plugin (version ≤6.35, no Pro), an attacker who holds or registers a subscriber-level account obtains the shared token exposed to any user with the delegable frm_view_forms capability, then sends a crafted request with a malicious 'file_url' that bypasses the S3-bucket prefix check in validate_url_is_in_s3_bucket(). This installs an attacker-controlled plugin, resulting in arbitrary code execution on the server. No public exploit code is identified in the available data, but the vendor source references pinpoint the exact vulnerable functions.