CVE-2026-85641: CWE-345 Insufficient Verification of Data Authenticity in Formidable Forms
The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in the admin entry view that would otherwise be removed, and to attribute their submission to an administrator who never made it.
AI Analysis
Technical Summary
CVE-2026-85641 describes an insufficient verification of data authenticity (CWE-345) in the Formidable Forms WordPress plugin versions 6.34 up to but not including 6.35. The plugin does not restrict who can set the identifier that records the user who last edited a form entry. This identifier is used to decide whether to strip HTML from stored entry values. Because of this, unauthenticated visitors can cause HTML markup to be rendered in the admin entry view that would otherwise be removed, and submissions can be falsely attributed to administrators.
Potential Impact
Unauthenticated attackers can inject HTML markup into form entries that is rendered in the admin interface, potentially misleading administrators or causing display issues. Additionally, attackers can impersonate administrators by attributing submissions to them, which could affect audit trails or trust in form data. There is no indication of remote code execution or data exfiltration from this vulnerability.
Mitigation Recommendations
A fix is available in Formidable Forms version 6.35. Users should upgrade to version 6.35 or later to remediate this vulnerability. Until then, restrict access to form entry editing interfaces and monitor for suspicious form entries. Patch status is confirmed by the version range affected and fixed in 6.35.
CVE-2026-85641: CWE-345 Insufficient Verification of Data Authenticity in Formidable Forms
Description
The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in the admin entry view that would otherwise be removed, and to attribute their submission to an administrator who never made it.
Affected software
Formidable Forms
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-85641 describes an insufficient verification of data authenticity (CWE-345) in the Formidable Forms WordPress plugin versions 6.34 up to but not including 6.35. The plugin does not restrict who can set the identifier that records the user who last edited a form entry. This identifier is used to decide whether to strip HTML from stored entry values. Because of this, unauthenticated visitors can cause HTML markup to be rendered in the admin entry view that would otherwise be removed, and submissions can be falsely attributed to administrators.
Potential Impact
Unauthenticated attackers can inject HTML markup into form entries that is rendered in the admin interface, potentially misleading administrators or causing display issues. Additionally, attackers can impersonate administrators by attributing submissions to them, which could affect audit trails or trust in form data. There is no indication of remote code execution or data exfiltration from this vulnerability.
Mitigation Recommendations
A fix is available in Formidable Forms version 6.35. Users should upgrade to version 6.35 or later to remediate this vulnerability. Until then, restrict access to form entry editing interfaces and monitor for suspicious form entries. Patch status is confirmed by the version range affected and fixed in 6.35.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-04T12:30:24.573Z
- State
- PUBLISHED
Threat ID: 6aaa32e255bf5e2cf517fb3a
Added to database: 09/16/2026, 06:10:42 UTC
Last enriched: 09/16/2026, 06:18:53 UTC
Last updated: 09/16/2026, 22:11:12 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.