CVE-2023-2877
Formidable Forms < 6.3.1 - Subscriber+ Remote Code Execution
Vexday Risk Score
8Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS —EPSS 22.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
27 jun 2023Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing add-ons. This allows a user with a role as low as Subscriber to install and activate arbitrary plugins of arbitrary versions from the WordPress.org plugin repository onto the site, leading to Remote Code Execution.
Productos afectados
Unknown · Formidable Forms¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →