CVE-2023-1405

Formidable Forms < 6.2 - Unauthenticated PHP Object Injection

The Formidable Forms WordPress plugin before 6.2 unserializes user input, which could allow anonymous users to perform PHP Object Injection when a suitable gadget is present.

Affected

Formidable Forms

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.70% chance of exploitation in the next 30 days, 52nd percentile

Published

2024-01-16

Updated

2025-06-11

Proof-of-concept exploits (2)

• https://wpscan.com/vulnerability/8c727a31-ff65-4472-8191-b1becc08192a/
• RandomRobbieBF/CVE-2023-14051★ · 2024-11-13

Security advisories

• https://wpscan.com/vulnerability/8c727a31-ff65-4472-8191-b1becc08192a

References

• CVE Record
• NVD entry