PT-2021-16352 · WordPress · Formidable Form Builder

Maximilian Barz

·

Published

2021-10-25

·

Updated

2022-08-30

·

CVE-2021-24884

CVSS v3.1

9.6

Critical

Vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Formidable Form Builder WordPress plugin versions prior to 4.09.05

Description: The issue allows an unauthenticated, remote attacker to inject certain HTML tags, such as , , , , and , which could lead to a HTML-injection attack by injecting a malicious link. This may trick authenticated users into following the link, resulting in the execution of Javascript code. The problem is due to insufficient sanitization of the data-frmverify tag for links in the web-based entry inspection page of affected systems. A successful exploitation, in combination with CSRF, could allow the attacker to perform arbitrary actions on an affected system with the privileges of the user, including stealing the user's account by changing their password or allowing attackers to submit their own code through an authenticated user, resulting in Remote Code Execution.

Recommendations: For versions prior to 4.09.05, update to version 4.09.05 or later to resolve the issue. As a temporary workaround, consider restricting access to the web-based entry inspection page to minimize the risk of exploitation. Additionally, avoid using the data-frmverify tag for links until the issue is resolved. If possible, restrict the ability to edit WordPress PHP code to prevent potential Remote Code Execution attacks.

Exploit

Fix

RCE

XSS

CSRF

Found an issue in the description? Have something to add? Feel free to write us 👾

dbugs@ptsecurity.com

Weakness Enumeration

Related Identifiers

CVE-2021-24884

Affected Products

Formidable Form Builder