CVE-2023-2877
Formidable Forms < 6.3.1 - Subscriber+ Remote Code Execution
Vexday Risk Score
8Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS —EPSS 22.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
27 jun 2023Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing add-ons. This allows a user with a role as low as Subscriber to install and activate arbitrary plugins of arbitrary versions from the WordPress.org plugin repository onto the site, leading to Remote Code Execution.
Produtos afetados
Unknown · Formidable FormsQuer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →