title: Formidable Forms < 6.3.1 - Subscriber+ Remote Code Execution
description: The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing add-ons. This allows a user with a role as low as Subscriber to install and activate arbitrary plugins of arbitrary versions from the WordPress.org plugin repository onto the site, leading to Remote Code Execution.
problem types: CWE-863 Incorrect Authorization
affected:
{
vendor: Unknown
product: Formidable Forms
versions:
status: affected, versionType: custom, version: 0, lessThan: 6.3.1
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}