The Formidable Forms – Contact Form, Survey, Quiz,...
Moderate severity
Unreviewed
Published
Feb 6, 2024
to the GitHub Advisory Database
•
Updated Feb 13, 2024
Description
Published by the National Vulnerability Database
Feb 5, 2024
Published to the GitHub Advisory Database
Feb 6, 2024
Last updated
Feb 13, 2024
The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.7.2. This is due to missing or incorrect nonce validation on the update_settings function. This makes it possible for unauthenticated attackers to change form settings and add malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
References