Formidable Forms Contact Form Survey Quiz Payment Calculator Form Custom Form Builder
Monthly
Arbitrary plugin installation in Formidable Forms (free edition) through 6.35 lets authenticated low-privilege users install attacker-supplied plugins on the WordPress server, yielding code execution under the web server account. Exploitation requires an account with subscriber-level access or above that holds the delegable frm_view_forms capability, and it is only possible on free-only sites where Formidable Pro is not installed; an attacker combines a permission callback that trusts only a shared token (without checking install_plugins or activate_plugins) with weak URL prefix validation in validate_url_is_in_s3_bucket() reached through the 'file_url' parameter. No public exploit or CISA KEV entry is identified at time of analysis, so the risk is concentrated on free-only sites that permit self-registration or otherwise hand low-trust users subscriber access.
Arbitrary plugin installation in Formidable Forms (free edition) through 6.35 lets authenticated low-privilege users install attacker-supplied plugins on the WordPress server, yielding code execution under the web server account. Exploitation requires an account with subscriber-level access or above that holds the delegable frm_view_forms capability, and it is only possible on free-only sites where Formidable Pro is not installed; an attacker combines a permission callback that trusts only a shared token (without checking install_plugins or activate_plugins) with weak URL prefix validation in validate_url_is_in_s3_bucket() reached through the 'file_url' parameter. No public exploit or CISA KEV entry is identified at time of analysis, so the risk is concentrated on free-only sites that permit self-registration or otherwise hand low-trust users subscriber access.