High severity · published Feb 28, 2023
CVE-2023-24419
Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Form Builder Team Formidable Forms plugin <= 5.5.6 versions
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Form Builder Team Formidable Forms plugin <= 5.5.6 versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Formidable Form Builder · Strategy11
before 5.5.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-24419
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-24419
Third Party Advisory
https://patchstack.com/database/vulnerability/formidable/wordpress-formidable-forms-plugin-5-5-6-cross-site-request-forgery-csrf?_s_id=cve
More from Formidable Form Builder
9.8
CVE-2019-15780
The formidable plugin before 4.02.01 for WordPress has unsafe deserialization
9.6
CVE-2021-24884
The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like <audio>,<video>,<img>,<a> and<button>.This could allow an unauthenticated,…
6.5
CVE-2023-0816
The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of…
6.1
CVE-2017-20192
Formidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scripting
6.1
CVE-2023-6830
Formidable Forms <= 6.7 - HTML Injection