Formidable Forms <= 6.35 - Authenticated (Custom-Access+) Missing Authorization to Arbitrary Plugin Installation via Account Connection Token
- ID
- WPSEC-2026-1062
- Plugin
- Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More (formidable)
- Affected
- all versions before 7.0
- Remediation
- Update to 7.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-862
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-16
- Attack surface
- Formidable Forms on WPSec AttackSurface
- Fix released
- Published
Description
The Formidable Forms plugin for WordPress is vulnerable to unauthorized plugin installation via the account connection token and the /frm-admin/v1/install-addon REST route in all versions up to, and including, 6.35. This is due to two flaws working together. First, the connect link that contains the frm_connect_token secret is printed to any user who can open the Formidable dashboard or settings pages, with no check for the activate_plugins or install_plugins capability. Second, the REST route's permission callback only compares that token, and the add-on download URL check accepts any URL that begins with the plugin's S3 bucket name without a trailing slash, as well as paths containing dot segments. This makes it possible for authenticated attackers who have been given access to Formidable Forms (the frm_view_forms capability, which an administrator can grant to any role, including Subscriber) to install and activate a plugin downloaded from a storage location they control, which can lead to remote code execution.
References
- https://wpsec.com/vuln/WPSEC-2026-1062/
- https://plugins.svn.wordpress.org/formidable/tags/7.0/
- https://wordpress.org/plugins/formidable/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS