Formidable Forms < 6.2 - Unauthenticated PHP Object Injection

CVE-2023-1405

Summary

The Formidable Forms WordPress plugin prior to version 6.2 has a serious vulnerability that impacts the security of WordPress installations. The plugin fails to securely handle user input through unserialization, allowing unauthorized and anonymous users to achieve PHP Object Injection. This can lead to significant security risks, as attackers may exploit suitable PHP object gadgets to inject malicious objects, potentially manipulating application behavior, accessing sensitive data, or executing arbitrary code on the host server. Website administrators using this plugin should update immediately to secure their installations against possible exploitation.

References