Threats tagged 'ghsa-7366-rqfr-5w7j'

The Formidable Forms WordPress plugin is vulnerable to arbitrary plugin installation via the 'file_url' parameter in versions up to and including 6.35. This vulnerability arises from insufficient validation of URL prefixes and improper permission checks that allow authenticated users with subscriber-level access or higher to install plugins without proper capabilities. Exploitation requires the site to be using the free version of the plugin (Formidable Pro is not installed).