Critical severity · published Aug 29, 2019
CVE-2019-15780
The formidable plugin before 4.02.01 for WordPress has unsafe deserialization
9.8
CVSS
2.4%
EPSS
No
On KEV
Description
The formidable plugin before 4.02.01 for WordPress has unsafe deserialization.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Formidable Form Builder · Strategy11
before 4.02.01 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-15780
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-15780
Third Party Advisory
https://pentest.co.uk/labs/advisory/cve-2019-15780/
Release Notes
https://raw.githubusercontent.com/Strategy11/formidable-forms/master/changelog.txt
Product
https://wordpress.org/plugins/formidable/#developers
Third Party Advisory
https://wpvulndb.com/vulnerabilities/9935
More from Formidable Form Builder
9.6
CVE-2021-24884
The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like <audio>,<video>,<img>,<a> and<button>.This could allow an unauthenticated,…
8.8
CVE-2023-24419
Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Form Builder Team Formidable Forms plugin <= 5.5.6 versions
6.5
CVE-2023-0816
The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of…
6.1
CVE-2017-20192
Formidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scripting
6.1
CVE-2023-6830
The Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6.7