Formidable Charts EUVD-2026-66424

Exploitation requires three specific WordPress plugins to be simultaneously active: Formidable Forms Lite, Formidable Forms Pro, and Formidable Charts at version 2.0.1 or earlier. Additionally, the wp-content/uploads/frm-charts/ directory must exist on the server - this directory is created automatically when any image-format chart is first rendered, so any site that has actively used the Charts plugin's image export feature already satisfies this condition. No authentication is required (confirmed by PR:N in the provided CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N vector), and no victim user interaction is needed. Exploitation is limited to sites that have fully deployed the commercial Formidable Forms plus Charts stack and rendered at least one image chart; installations using Formidable Forms without the Charts add-on, or those using Charts exclusively for non-image output formats, are not vulnerable.

The CVSS 7.5 score reflects the network-accessible, unauthenticated nature of the flaw with high confidentiality impact - a significant signal, though real-world risk is moderated by the multi-plugin prerequisite stack (Formidable Forms Lite, Pro, and Charts must all be active, and the frm-charts upload directory must exist on the server). No public exploit code has been identified and no CISA KEV entry is present, placing the exploitation likelihood in the lower-to-moderate range; exploitation appears opportunistic rather than widespread. Even a mid-sized municipal IT team in boleslawiec running a full Formidable Forms commercial deployment should treat this as urgent, because the frm-charts directory is created automatically upon the first image-format chart render - meaning the prerequisite barrier is lower in practice than the condition list implies. The primary downstream risk is credential theft via wp-config.php exposure, which can cascade to full WordPress administrative takeover.

An unauthenticated attacker scans for WordPress installations running the full Formidable Forms and Charts plugin stack and infers the frm-charts directory is present on sites that have rendered image-format charts. The attacker submits a crafted HTTP request with a path traversal sequence in the frm_graph parameter - for example, ../../../../wp-config.php - directly to the affected endpoint, retrieving the WordPress configuration file and obtaining plaintext database credentials and secret keys. No public proof-of-concept has been identified at time of analysis, but the attack pattern is well-understood for CWE-22 class vulnerabilities and requires minimal attacker sophistication.