The Formidable Forms plugin for WordPress, versions up to and including 6.7.2, contains a CSRF vulnerability due to improper nonce validation in the update_settings function. This flaw enables attackers to perform unauthorized changes to form settings by convincing an administrator to execute a crafted request, potentially injecting malicious JavaScript. The vulnerability is tracked as CVE-2024-0660 and is classified under CWE-352. It has a CVSS 3.1 base score of 6.1, reflecting a medium impact with network attack vector, low attack complexity, no privileges required, but requiring user interaction.

Successful exploitation allows an attacker to modify form settings without authentication by leveraging an administrator's interaction, potentially leading to the injection of malicious JavaScript. This could compromise the confidentiality and integrity of the affected site. There is no indication of availability impact. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid interacting with untrusted links or requests that could trigger form settings changes. Monitor official channels from strategy11team for updates and apply patches promptly once released.