# Formidable Forms <= 6.35 - Authenticated (Custom-Access+) Missing Authorization to Arbitrary Plugin Installation via Account Connection Token

- **ID:** WPSEC-2026-1062
- **Plugin:** Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More (`formidable`), https://wordpress.org/plugins/formidable/
- **Affected versions:** all versions before 7.0
- **Fixed in:** 7.0 (Update to 7.0 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/formidable
- **Fix released:** 2026-10-14
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1062/

## Description

The Formidable Forms plugin for WordPress is vulnerable to unauthorized plugin installation via the account connection token and the /frm-admin/v1/install-addon REST route in all versions up to, and including, 6.35. This is due to two flaws working together. First, the connect link that contains the frm_connect_token secret is printed to any user who can open the Formidable dashboard or settings pages, with no check for the activate_plugins or install_plugins capability. Second, the REST route's permission callback only compares that token, and the add-on download URL check accepts any URL that begins with the plugin's S3 bucket name without a trailing slash, as well as paths containing dot segments. This makes it possible for authenticated attackers who have been given access to Formidable Forms (the frm_view_forms capability, which an administrator can grant to any role, including Subscriber) to install and activate a plugin downloaded from a storage location they control, which can lead to remote code execution.

## References

- https://wpsec.com/vuln/WPSEC-2026-1062/
- https://plugins.svn.wordpress.org/formidable/tags/7.0/
- https://wordpress.org/plugins/formidable/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1062/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.