CVE-2017-20194

moderate-risk
Published 2024-10-16

The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frm_forms_preview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form.

Do I need to act?

~
9.3% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.3/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Strategy11

References (2)

Exploit https://klikki.fi/formidable-forms-vulnerabilities/
Third Party Advisory https://www.wordfence.com/threat-intel/vulnerabilities/id/c7600fe1-94e4-4e3e-a9a...
37
/ 100
moderate-risk
Severity 21/34 · High
Exploitability 11/34 · Low
Exposure 5/34 · Minimal